General
-
Target
DHL AWB #32536063331.exe
-
Size
628KB
-
Sample
240129-rdvttsbdg4
-
MD5
95beead82533c654a3fc4575b4c777e9
-
SHA1
8569c820d6ec3cb57482a417ab31be76bc4e70ec
-
SHA256
35eec5e5dda33e2c7ea807619a3813a9e0562dc97fd5038e57eb519d86b5e572
-
SHA512
d701a8966d963843e7027e04e333b792c16527748ac593a6e7b0c25c3b5cf8c36b391da00b9da7c847b8d5efcda359f3d8bdd4c98bc16b680a6b70cd7662f2e2
-
SSDEEP
12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLCLDZZ:AQy6ONsqLCLNhTr3
Static task
static1
Behavioral task
behavioral1
Sample
DHL AWB #32536063331.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
DHL AWB #32536063331.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
keywords.vbs
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
keywords.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
vtablog.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
vtablog.dll
Resource
win10v2004-20231215-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
fresh01.ddns.net:2256
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
Logs.exe
-
install_folder
%AppData%
Targets
-
-
Target
DHL AWB #32536063331.exe
-
Size
628KB
-
MD5
95beead82533c654a3fc4575b4c777e9
-
SHA1
8569c820d6ec3cb57482a417ab31be76bc4e70ec
-
SHA256
35eec5e5dda33e2c7ea807619a3813a9e0562dc97fd5038e57eb519d86b5e572
-
SHA512
d701a8966d963843e7027e04e333b792c16527748ac593a6e7b0c25c3b5cf8c36b391da00b9da7c847b8d5efcda359f3d8bdd4c98bc16b680a6b70cd7662f2e2
-
SSDEEP
12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLCLDZZ:AQy6ONsqLCLNhTr3
Score10/10-
Async RAT payload
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
17ed1c86bd67e78ade4712be48a7d2bd
-
SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
-
SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
-
SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
-
SSDEEP
192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
Score3/10 -
-
-
Target
keywords.txt
-
Size
1010B
-
MD5
4d3c8d141484bbb0b8be03c13894ec9f
-
SHA1
1fbb29a4d6a1f48745e6d67bfa110306bc54c6ba
-
SHA256
c74e743057bfb38a767f3666df1d16587e2e529a070d1621be0e737366011471
-
SHA512
e4b9dd5c3585c24301ac71d7849616d680b25d2b340192c31c3de38a9546564cb30aa1b08bdbcba9e3b87303cd5f3bdb93e37c399bc9d056a68b9bbc7a0a3329
Score1/10 -
-
-
Target
vtablog.dll
-
Size
268KB
-
MD5
35119e61479373ba5d7433f106556e79
-
SHA1
096a7d227eb2514d76ec5d10bfd1cf165d4a9177
-
SHA256
f21d9de02c67e51bb9f7163f676f2d4710b2befae04fd0751a63cf1278c48a3c
-
SHA512
21318d0924393c8269419df5acc0c07ca2f754fd9d9ad80d393cf7ebec1b16986d123f2775ae210383b7faa106ed84e829c949004a123da844c07f2b46387453
-
SSDEEP
3072:s1vaCg+eY9yp71driAAYBnk/+eeaQyJen3n83fucakiD88iryUBw:ovDgZYq/rzfNufuceD5UBw
Score1/10 -