General
-
Target
Reaper.exe
-
Size
8.4MB
-
Sample
240522-fs3bnsda7v
-
MD5
caa418507bb991b91bbfa3e52623c2f4
-
SHA1
9e1083e019ca8813024e1e58eac193d7a83b4b48
-
SHA256
a8e3cbf1921a2485a307ac0ff2536accc77bc17db386a00e8d67c5537613b321
-
SHA512
84e57b9c0d88e67c2ebb3ef89df82b33b4d466b663fa1b43dd0c050b140fbc986135169c8840b4d91ed5921379579a85e743cda27184172a7a7eb87156c61684
-
SSDEEP
196608:SRyi9wysiM2+eLNxHPZe/eAwfPjprt/VU3jZoAp/aOROsEh/cH:SRLSIr+eLDvM9YBNMrQsh
Static task
static1
Malware Config
Extracted
asyncrat
L838 RAT v1.0.0
Default
127.0.0.1:54984
127.0.0.1:4449
l838.ddns.net:54984
l838.ddns.net:4449
azjrpxchkiev
-
delay
1
-
install
true
-
install_file
Windows Driver Foundation.exe
-
install_folder
%Temp%
Extracted
xworm
l838.ddns.net:3232
-
Install_directory
%Public%
-
install_file
Windows Service Wrapper.exe
Targets
-
-
Target
Reaper.exe
-
Size
8.4MB
-
MD5
caa418507bb991b91bbfa3e52623c2f4
-
SHA1
9e1083e019ca8813024e1e58eac193d7a83b4b48
-
SHA256
a8e3cbf1921a2485a307ac0ff2536accc77bc17db386a00e8d67c5537613b321
-
SHA512
84e57b9c0d88e67c2ebb3ef89df82b33b4d466b663fa1b43dd0c050b140fbc986135169c8840b4d91ed5921379579a85e743cda27184172a7a7eb87156c61684
-
SSDEEP
196608:SRyi9wysiM2+eLNxHPZe/eAwfPjprt/VU3jZoAp/aOROsEh/cH:SRLSIr+eLDvM9YBNMrQsh
-
Detect Xworm Payload
-
Async RAT payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-