General
-
Target
4959354bc88fa421bf98bb93a9f0f2aee6e3830fd816e726b22257e4a983af80_JC.unknown
-
Size
430KB
-
Sample
231011-ngyhcabe3w
-
MD5
3522c1f7f4328df9bcd67cf7aad28eae
-
SHA1
4b91582c6fc365877b23dce2b3a7782dd3dd057f
-
SHA256
4959354bc88fa421bf98bb93a9f0f2aee6e3830fd816e726b22257e4a983af80
-
SHA512
c3f466a4435b0d89fe72b913e422347a855f8179b95a8fd4dafde8108a6eac7d7c52404076342cc876e82ca83885a0dadbceb4d9fcb9c4a99f7dd30b2c960d18
-
SSDEEP
3072:w4xxUF6xj08315d3Apo4ypzUeE6Ue+VM8fpBTUv1vZuWQIG7Dl8a:w4xxeQj08315d3Apo0VNRBRWQIM
Static task
static1
Behavioral task
behavioral1
Sample
4959354bc88fa421bf98bb93a9f0f2aee6e3830fd816e726b22257e4a983af80_JC.ps1
Resource
win7-20230831-en
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
joker
45.138.16.87:998
lol1112s.sells-it.net:998
l11ol12s.sells-it.net:998
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
4959354bc88fa421bf98bb93a9f0f2aee6e3830fd816e726b22257e4a983af80_JC.unknown
-
Size
430KB
-
MD5
3522c1f7f4328df9bcd67cf7aad28eae
-
SHA1
4b91582c6fc365877b23dce2b3a7782dd3dd057f
-
SHA256
4959354bc88fa421bf98bb93a9f0f2aee6e3830fd816e726b22257e4a983af80
-
SHA512
c3f466a4435b0d89fe72b913e422347a855f8179b95a8fd4dafde8108a6eac7d7c52404076342cc876e82ca83885a0dadbceb4d9fcb9c4a99f7dd30b2c960d18
-
SSDEEP
3072:w4xxUF6xj08315d3Apo4ypzUeE6Ue+VM8fpBTUv1vZuWQIG7Dl8a:w4xxeQj08315d3Apo0VNRBRWQIM
-
Async RAT payload
-
Suspicious use of SetThreadContext
-