General
-
Target
thasupreme2(2).exe
-
Size
48KB
-
Sample
230408-t1cymseb39
-
MD5
f66940a7ab4f7db4534b0da7a155741d
-
SHA1
3b0ec707455c8c0b2a465a386b68634b41afe4e2
-
SHA256
e9862583e03d49e791f0aaabb974ba4054cea75a57fec9660b59dd3342cd65de
-
SHA512
1ab6588d07b77e852265285e8b86c598638823628d03759e2f116455bce3adf628165eb79eee6517d3f3227879009e72d7de69086e0e16a98f4d492b3b354063
-
SSDEEP
768:2duRtILkWAA+jiYH/lDB2Oaig8Yblge1+A8aLfRvEgK/JYBVc6KN:2duNoYH/l92OSzbifoJnkJYBVclN
Behavioral task
behavioral1
Sample
thasupreme2(2).exe
Resource
win7-20230220-en
Malware Config
Extracted
asyncrat
1.0.7
System
147.185.221.180:1491
llfesnjkqacrdhbtbu
-
delay
1
-
install
true
-
install_file
THASUPREMETROJAN.exe
-
install_folder
%AppData%
Targets
-
-
Target
thasupreme2(2).exe
-
Size
48KB
-
MD5
f66940a7ab4f7db4534b0da7a155741d
-
SHA1
3b0ec707455c8c0b2a465a386b68634b41afe4e2
-
SHA256
e9862583e03d49e791f0aaabb974ba4054cea75a57fec9660b59dd3342cd65de
-
SHA512
1ab6588d07b77e852265285e8b86c598638823628d03759e2f116455bce3adf628165eb79eee6517d3f3227879009e72d7de69086e0e16a98f4d492b3b354063
-
SSDEEP
768:2duRtILkWAA+jiYH/lDB2Oaig8Yblge1+A8aLfRvEgK/JYBVc6KN:2duNoYH/l92OSzbifoJnkJYBVclN
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-