General
-
Target
54c5be1e2056c9d591b7e35853ca4a84
-
Size
585KB
-
Sample
240111-2lhjksaff4
-
MD5
54c5be1e2056c9d591b7e35853ca4a84
-
SHA1
c00bd4d0c3b6060dde5095c4c6938badf1b29eda
-
SHA256
0430110381976669226247e7c5403ac61f4d419c7fa223231ce5c9af7cd3bbf1
-
SHA512
8d6e219729f8a981c94b7e8d7b5f2bf764367b096381abaa3033171c590587b00ced309e641a9955f60c3836fc366c91bfd90414216373cd91e66ab2f24a4c75
-
SSDEEP
6144:5jrbYSqQ/Gq/lqLrBOOfd0tV9D8DT/XELB:5nb/xq0V9ATfWB
Static task
static1
Behavioral task
behavioral1
Sample
54c5be1e2056c9d591b7e35853ca4a84.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
54c5be1e2056c9d591b7e35853ca4a84.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
asyncrat
0.5.7B
WIRE$$$$$$$$
severdops.ddns.net:6204
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
iconfx.exe
-
install_folder
%AppData%
Targets
-
-
Target
54c5be1e2056c9d591b7e35853ca4a84
-
Size
585KB
-
MD5
54c5be1e2056c9d591b7e35853ca4a84
-
SHA1
c00bd4d0c3b6060dde5095c4c6938badf1b29eda
-
SHA256
0430110381976669226247e7c5403ac61f4d419c7fa223231ce5c9af7cd3bbf1
-
SHA512
8d6e219729f8a981c94b7e8d7b5f2bf764367b096381abaa3033171c590587b00ced309e641a9955f60c3836fc366c91bfd90414216373cd91e66ab2f24a4c75
-
SSDEEP
6144:5jrbYSqQ/Gq/lqLrBOOfd0tV9D8DT/XELB:5nb/xq0V9ATfWB
Score10/10-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-