General
-
Target
Bygay Ultimatum.exe
-
Size
111KB
-
Sample
240522-yv23sseg95
-
MD5
69a08abd99af2c0de3ddae4f041579e2
-
SHA1
de04d6d17aea96d673f0ded3cb5731d4b62b97bc
-
SHA256
34ddc970cca5e3a8646c6355d21d74c3c6405871f14306740b420395c3df65a7
-
SHA512
bd1244e34d6fa7fa080e272fe5371e6f1318a90b864da18aff14b999496fc64d1bb9a4573d6ce749f20cda631a05f64bdbdb86c100840cb1171eedaa29947b25
-
SSDEEP
3072:p1HXoZq4xFSz8BIVJ91frkQIi/URe8642ZCUeFQ:fXSq4HSz8BIwBi/UM86xleF
Static task
static1
Behavioral task
behavioral1
Sample
Bygay Ultimatum.exe
Resource
win7-20240220-en
Malware Config
Extracted
asyncrat
Default
polaris1314-38723.portmap.host:38723
-
delay
1
-
install
true
-
install_file
svchost.exe
-
install_folder
%Temp%
Targets
-
-
Target
Bygay Ultimatum.exe
-
Size
111KB
-
MD5
69a08abd99af2c0de3ddae4f041579e2
-
SHA1
de04d6d17aea96d673f0ded3cb5731d4b62b97bc
-
SHA256
34ddc970cca5e3a8646c6355d21d74c3c6405871f14306740b420395c3df65a7
-
SHA512
bd1244e34d6fa7fa080e272fe5371e6f1318a90b864da18aff14b999496fc64d1bb9a4573d6ce749f20cda631a05f64bdbdb86c100840cb1171eedaa29947b25
-
SSDEEP
3072:p1HXoZq4xFSz8BIVJ91frkQIi/URe8642ZCUeFQ:fXSq4HSz8BIwBi/UM86xleF
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-