General
-
Target
Infected.exe
-
Size
63KB
-
Sample
240626-b76kesxdpe
-
MD5
8406bf53e6f2457c5fffb895943b04c1
-
SHA1
c496e3ab44710259f5d9a5153d4471c2cfc6184f
-
SHA256
a55c7ed8b626f509f1db86fb6be1823a6bdf54b47c73a348cfe70c36e8b45d82
-
SHA512
77e81537492c79e62ef92d199f8db61b43f15d3c192472a908f798f10e480434eb14f96e850dc5d4302311bd28895fe862078e0f357ef06d5880e8e1f2d730d5
-
SSDEEP
768:jnuguX1wbgyX78dIC8A+XkuazcBRL5JTk1+T4KSBGHmDbD/ph0oXXOP+5Y/9rWS3:rvCCPTDdSJYUbdh9em5Y/7uEdpqKmY7
Malware Config
Extracted
asyncrat
Default
147.185.221.20:36797
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
Infected.exe
-
Size
63KB
-
MD5
8406bf53e6f2457c5fffb895943b04c1
-
SHA1
c496e3ab44710259f5d9a5153d4471c2cfc6184f
-
SHA256
a55c7ed8b626f509f1db86fb6be1823a6bdf54b47c73a348cfe70c36e8b45d82
-
SHA512
77e81537492c79e62ef92d199f8db61b43f15d3c192472a908f798f10e480434eb14f96e850dc5d4302311bd28895fe862078e0f357ef06d5880e8e1f2d730d5
-
SSDEEP
768:jnuguX1wbgyX78dIC8A+XkuazcBRL5JTk1+T4KSBGHmDbD/ph0oXXOP+5Y/9rWS3:rvCCPTDdSJYUbdh9em5Y/7uEdpqKmY7
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Stealerium
An open source info stealer written in C# first seen in May 2022.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-