General
-
Target
pp
-
Size
210KB
-
Sample
230330-ltwheade7y
-
MD5
90ada38693288cabfc3be095ef37cb55
-
SHA1
66c780453c1465bd82a2e50c21ac312eef3299b1
-
SHA256
bf6bcae7ffd342431c3e51e3e2bf2874fb2f58db414fd71b0a47bbecc7faa343
-
SHA512
bb0e2ceae71b344afb38bbc45be99374e6dbc5f98ed5d47780bf7fa5a06c64355a74fcc6c076f2d24e8976fd848d7ae4fee686f6e57a6cda61748c5afd00f9db
-
SSDEEP
3072:3TPTwLhFrOBsc4VsTKkcU/DNv9O9d2rBoOSpG2JeiptowmGcAh3Apq:/wLKpKkcUbNv9OyNodlpowmGcAh3Apq
Static task
static1
Behavioral task
behavioral1
Sample
pp.ps1
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
pp.ps1
Resource
win10v2004-20230220-en
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
ppppp101010
pop12.linkpc.net:6606
pop12.linkpc.net:7707
pop12.linkpc.net:8808
pop12.linkpc.net:6666
pop12.linkpc.net:555
45.80.158.108:6606
45.80.158.108:7707
45.80.158.108:8808
45.80.158.108:6666
45.80.158.108:555
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
pp
-
Size
210KB
-
MD5
90ada38693288cabfc3be095ef37cb55
-
SHA1
66c780453c1465bd82a2e50c21ac312eef3299b1
-
SHA256
bf6bcae7ffd342431c3e51e3e2bf2874fb2f58db414fd71b0a47bbecc7faa343
-
SHA512
bb0e2ceae71b344afb38bbc45be99374e6dbc5f98ed5d47780bf7fa5a06c64355a74fcc6c076f2d24e8976fd848d7ae4fee686f6e57a6cda61748c5afd00f9db
-
SSDEEP
3072:3TPTwLhFrOBsc4VsTKkcU/DNv9O9d2rBoOSpG2JeiptowmGcAh3Apq:/wLKpKkcUbNv9OyNodlpowmGcAh3Apq
Score10/10-
Async RAT payload
-
Suspicious use of SetThreadContext
-