General
-
Target
f8eb456776edf06cd08eac96aaedd5108737a563c6441e0dd61759631d567271
-
Size
57KB
-
Sample
231208-h3mebabb41
-
MD5
51584394f75ed4494c7bfabe52820d42
-
SHA1
afa8dc5f9d9a9cc9685513facb68ba29f62b9df6
-
SHA256
f8eb456776edf06cd08eac96aaedd5108737a563c6441e0dd61759631d567271
-
SHA512
91d971919bad493431acc155b0aa9bfdf2162114c87ec171a5467c06a6eeacd41fe22aa815d6fa6cfe6cf7ef15cdb68680f7ff402d2ef4feaef12a3695ae4ca3
-
SSDEEP
384:WI9PW37/X/BbZekHSFhunTzJhfHt4W7XzuHRN7rpb045DNR9zO0q:WIVW3T/Bb6FhAz/lVza1b9z
Static task
static1
Behavioral task
behavioral1
Sample
f8eb456776edf06cd08eac96aaedd5108737a563c6441e0dd61759631d567271.exe
Resource
win10-20231023-en
Malware Config
Extracted
asyncrat
0.5.7B
Winlogoew
46.1.103.124:2341
Winlogore
-
delay
3
-
install
false
-
install_file
Winlog
-
install_folder
%AppData%
Extracted
asyncrat
0.5.7B
Winlogoewg
46.1.103.124:9371
Winlogoreg
-
delay
3
-
install
false
-
install_file
Winloggg
-
install_folder
%AppData%
Targets
-
-
Target
f8eb456776edf06cd08eac96aaedd5108737a563c6441e0dd61759631d567271
-
Size
57KB
-
MD5
51584394f75ed4494c7bfabe52820d42
-
SHA1
afa8dc5f9d9a9cc9685513facb68ba29f62b9df6
-
SHA256
f8eb456776edf06cd08eac96aaedd5108737a563c6441e0dd61759631d567271
-
SHA512
91d971919bad493431acc155b0aa9bfdf2162114c87ec171a5467c06a6eeacd41fe22aa815d6fa6cfe6cf7ef15cdb68680f7ff402d2ef4feaef12a3695ae4ca3
-
SSDEEP
384:WI9PW37/X/BbZekHSFhunTzJhfHt4W7XzuHRN7rpb045DNR9zO0q:WIVW3T/Bb6FhAz/lVza1b9z
Score10/10-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-