General
-
Target
2024-03-13_156cd53bc5d2472d6f609f956c99351f_mafia
-
Size
2.4MB
-
Sample
240313-aqsrkahb68
-
MD5
156cd53bc5d2472d6f609f956c99351f
-
SHA1
524ebcf9e029dd6e43d8d1b81ee84476cbad0270
-
SHA256
9b09bfe79653270e1c6248815996b4710d1c3e7a2b64dfa221d953369963ea03
-
SHA512
a9db7823bdaf4816ad40bae933fd57dc876514793d2fc4e03bc5e18f4b14dcd3a882a5878708a0bfc34171c77c6f24fb6ad218e67f77c2804730a72230cc438b
-
SSDEEP
12288:/k1MoO3MBURL+8hiLzq5ot1tLA9BqgiyUDHXQsHvBqgiyUDHD7ApBERoMsqQAmQw:qML3Ga0HqQNyUD3NHvQNyUDjwBQWEmD
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-13_156cd53bc5d2472d6f609f956c99351f_mafia.exe
Resource
win7-20240221-en
Malware Config
Extracted
asyncrat
XieBroRAT-1.7
Default
117.18.12.59:8880
kincbmvclpa
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
2024-03-13_156cd53bc5d2472d6f609f956c99351f_mafia
-
Size
2.4MB
-
MD5
156cd53bc5d2472d6f609f956c99351f
-
SHA1
524ebcf9e029dd6e43d8d1b81ee84476cbad0270
-
SHA256
9b09bfe79653270e1c6248815996b4710d1c3e7a2b64dfa221d953369963ea03
-
SHA512
a9db7823bdaf4816ad40bae933fd57dc876514793d2fc4e03bc5e18f4b14dcd3a882a5878708a0bfc34171c77c6f24fb6ad218e67f77c2804730a72230cc438b
-
SSDEEP
12288:/k1MoO3MBURL+8hiLzq5ot1tLA9BqgiyUDHXQsHvBqgiyUDHD7ApBERoMsqQAmQw:qML3Ga0HqQNyUD3NHvQNyUDjwBQWEmD
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-