General
-
Target
file.exe
-
Size
307KB
-
Sample
230601-skk4mseh95
-
MD5
884714bd845895cbd4377d1ba6df376e
-
SHA1
5a219cb01a10516eab59b2703d7bc4760fb5b5c0
-
SHA256
5c85b25b5b4f277770b21a77796e7e1672eb046eabb76077c703a993e237a3a7
-
SHA512
174a7585784d24e4424661a03fbcd4f4195ec9b0b36cf4e01ea7fe5f5c5d7cbed2a74cb3a030531045e57af0c7e07d53e44e7e9f3d888883ee37ea21f4da0674
-
SSDEEP
6144:Y1s6ZKvncbumIED8Qyl/RUpfPMm9Fy5RiLwFdhLoZxybN:pcbuLQyDebTLIdhLexG
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
192.3.101.190:2015
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
file.exe
-
Size
307KB
-
MD5
884714bd845895cbd4377d1ba6df376e
-
SHA1
5a219cb01a10516eab59b2703d7bc4760fb5b5c0
-
SHA256
5c85b25b5b4f277770b21a77796e7e1672eb046eabb76077c703a993e237a3a7
-
SHA512
174a7585784d24e4424661a03fbcd4f4195ec9b0b36cf4e01ea7fe5f5c5d7cbed2a74cb3a030531045e57af0c7e07d53e44e7e9f3d888883ee37ea21f4da0674
-
SSDEEP
6144:Y1s6ZKvncbumIED8Qyl/RUpfPMm9Fy5RiLwFdhLoZxybN:pcbuLQyDebTLIdhLexG
Score10/10-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-