General
-
Target
2af994c5d5625be98c89248dca5bce26a40debf6b3c7b3b775a5ae916427a18b.exe
-
Size
140KB
-
Sample
240229-f1458seh78
-
MD5
a4ddde2d6e9370b5cc5572f97eb2071d
-
SHA1
ee88603b9e64f3af4de73a3a5f6f2676a84dafd8
-
SHA256
2af994c5d5625be98c89248dca5bce26a40debf6b3c7b3b775a5ae916427a18b
-
SHA512
5174a7bbe499db1e0a2ba944d11e6c70c308265962376a0577f1816f9b88afe185b55fa3a649e722ad753c05d4ccd0a26c3d0dc0a9142a57e5ae850d7912b247
-
SSDEEP
3072:FiGpa7x6bEGuXYEzNfRWtA2zvigEyapFS/b6JQ9LaeMR:FiKa7kbwoEZqji9i/6QnQ
Static task
static1
Behavioral task
behavioral1
Sample
2af994c5d5625be98c89248dca5bce26a40debf6b3c7b3b775a5ae916427a18b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2af994c5d5625be98c89248dca5bce26a40debf6b3c7b3b775a5ae916427a18b.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
asyncrat
| nelsontriana980
Asegurar-Casa
subdominiodesub.duckdns.org:1111
AsyncMutex_GNhcP0aLwKV1
-
delay
3
-
install
false
-
install_file
WD.exe
-
install_folder
%AppData%
Targets
-
-
Target
2af994c5d5625be98c89248dca5bce26a40debf6b3c7b3b775a5ae916427a18b.exe
-
Size
140KB
-
MD5
a4ddde2d6e9370b5cc5572f97eb2071d
-
SHA1
ee88603b9e64f3af4de73a3a5f6f2676a84dafd8
-
SHA256
2af994c5d5625be98c89248dca5bce26a40debf6b3c7b3b775a5ae916427a18b
-
SHA512
5174a7bbe499db1e0a2ba944d11e6c70c308265962376a0577f1816f9b88afe185b55fa3a649e722ad753c05d4ccd0a26c3d0dc0a9142a57e5ae850d7912b247
-
SSDEEP
3072:FiGpa7x6bEGuXYEzNfRWtA2zvigEyapFS/b6JQ9LaeMR:FiKa7kbwoEZqji9i/6QnQ
Score10/10-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects executables packed with SmartAssembly
-
Detects file containing reversed ASEP Autorun registry keys
-
Suspicious use of SetThreadContext
-