General
-
Target
H-Malware Builder V5.exe
-
Size
407KB
-
Sample
240619-xh85xaxakg
-
MD5
c8f6d76b4ae82978272bde392561c4f4
-
SHA1
80447d36fcf88cc9caa806db53e22d9468cc31ee
-
SHA256
c981ebcf0c0cf857162ae35b9385c22d3198c2ec9ea00e37fcfe74a79eb3510e
-
SHA512
10fa87f050a9ceb658e443317158ef8b1dbaa9e183ec61b5e5e42adb562f7918d996134aba7f0bbad852def4d6b0824c7b9716628b554194d0fd95974de6b2ad
-
SSDEEP
12288:r5p4UNBN3aqeKNoRfwoZrHMBV9EwEcb8+DvtuWUb:r9N3aqPCRooZwBjEhcYcvYWUb
Static task
static1
Behavioral task
behavioral1
Sample
H-Malware Builder V5.exe
Resource
win7-20240221-en
Malware Config
Extracted
asyncrat
1.0.7
Default
bay-helps.gl.at.ply.gg:36538
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
H-Malware Builder V5.exe
-
Size
407KB
-
MD5
c8f6d76b4ae82978272bde392561c4f4
-
SHA1
80447d36fcf88cc9caa806db53e22d9468cc31ee
-
SHA256
c981ebcf0c0cf857162ae35b9385c22d3198c2ec9ea00e37fcfe74a79eb3510e
-
SHA512
10fa87f050a9ceb658e443317158ef8b1dbaa9e183ec61b5e5e42adb562f7918d996134aba7f0bbad852def4d6b0824c7b9716628b554194d0fd95974de6b2ad
-
SSDEEP
12288:r5p4UNBN3aqeKNoRfwoZrHMBV9EwEcb8+DvtuWUb:r9N3aqPCRooZwBjEhcYcvYWUb
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Async RAT payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-