Overview
overview
10Static
static
1BYBBLJDYNKYQRCIW.ps1
windows7-x64
3BYBBLJDYNKYQRCIW.ps1
windows10-2004-x64
10LOEVIQHNNBLMJQGX.vbs
windows7-x64
3LOEVIQHNNBLMJQGX.vbs
windows10-2004-x64
7NOXOIMAYDCJQRTDL.bat
windows7-x64
8NOXOIMAYDCJQRTDL.bat
windows10-2004-x64
8PLYEDPJAJZDJPATK.vbs
windows7-x64
3PLYEDPJAJZDJPATK.vbs
windows10-2004-x64
7XKAHEZZHLYETQDGK.bat
windows7-x64
8XKAHEZZHLYETQDGK.bat
windows10-2004-x64
8YEJVMCIJLIUXHSQV.ps1
windows7-x64
3YEJVMCIJLIUXHSQV.ps1
windows10-2004-x64
3General
-
Target
tuqlskzrqvewwjwc.zip
-
Size
89KB
-
Sample
240627-xd26ssvcrf
-
MD5
487badd8b926d78a670d66f24d854545
-
SHA1
a1eb4ebe8146331689cfb239beb0e75c1b0875c0
-
SHA256
e6b6bacad6bf1d3188ff8c2a41ea9f0aaa5114504da4ae8bda96c673f5e10c94
-
SHA512
fa833a1602c728423d3aebeb5b678aecc89c7d2a64f3b3a6a966ea8e8ef5c069bbee53f980e50e9dd326f613a83c26bbbc2df399416c93c1bafe2b1fa18ed222
-
SSDEEP
1536:7jJxlkAiJFpAHwjjpIjvl/5vF4vkvkx3INq8VbVwkMJid4IMLwIClIIVu:P3545BYF59d8RINq8VakH48T/u
Static task
static1
Behavioral task
behavioral1
Sample
BYBBLJDYNKYQRCIW.ps1
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
BYBBLJDYNKYQRCIW.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
LOEVIQHNNBLMJQGX.vbs
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
LOEVIQHNNBLMJQGX.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
NOXOIMAYDCJQRTDL.bat
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
NOXOIMAYDCJQRTDL.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
PLYEDPJAJZDJPATK.vbs
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
PLYEDPJAJZDJPATK.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
XKAHEZZHLYETQDGK.bat
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
XKAHEZZHLYETQDGK.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
YEJVMCIJLIUXHSQV.ps1
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
YEJVMCIJLIUXHSQV.ps1
Resource
win10v2004-20240508-en
Malware Config
Extracted
asyncrat
AWS | 3Losh
newjop
backwork07.ddns.net:6666
AsyncMutex_raTMpP7xS21cDAE8
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
BYBBLJDYNKYQRCIW.ps1
-
Size
553KB
-
MD5
223b842e87e7d124f133e2b21090e717
-
SHA1
99c830f860fe5d34b3802a62c790e0c26c7f1e5b
-
SHA256
1c8e29dbcd8795f22f73483b6e20929e0025fd113cd9b7b760aaf5aec3b5b9ee
-
SHA512
f83274a71a388b0349cdbfed15ae152cfd3dfb45c22d81171a4e1a74f0a298a53b68d53fc75e15b8b08195f8d5020f33397d5d33dac2aa8826a5894680555db6
-
SSDEEP
1536:kDh8DyXBs84VhDEak0EyxWq0IxZQjepORUXl9cGnZneXVsl6cGMyQxI:kDhiyXBs84VhDEakbyxWq0IYz2I
-
Suspicious use of SetThreadContext
-
-
-
Target
LOEVIQHNNBLMJQGX.vbs
-
Size
820B
-
MD5
3b02a48a86c436a42cece067efd1616d
-
SHA1
7963c51e6de1389ea22c2fdff4f6ad436556e891
-
SHA256
adc0a2c378fc9c87efbb3863c49fa0ac2a25e32a69e320105b79878d1bbcfca6
-
SHA512
cf0d9bc3e908e7a3153529e1e975d98806e632f3e5ce708e1c15f64749214d7ac4a02496af99a3a3af382c4ebb89ac31b3d03787303678c3b6b37158816e3523
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
NOXOIMAYDCJQRTDL.bat
-
Size
1KB
-
MD5
f0615a271904779ef01a22ccffc5b7ac
-
SHA1
b18bab505208a2d1a53f7496286f25ac199b7475
-
SHA256
5e91677a0a32ced94580bef9253982462f9d9a7e5f2166a07561fe13f4342e98
-
SHA512
caa35c7111c525d8385e14b51368f657f9232b606dd6aa27fb580884264d0215435de234b4bfc155ec006107dfd94da978a73331442a2fd19c310348e3d758a2
Score8/10 -
-
-
Target
PLYEDPJAJZDJPATK.vbs
-
Size
887B
-
MD5
993627e0d502460f2b211b906e7f5cb7
-
SHA1
59d6ae8236d27c8f2f2b5abdc51ea77680e4455a
-
SHA256
735461ba3154b4804533018cf78b53bcf1fceff7688b3c3c64952ff0f6f04125
-
SHA512
fc85dfa5b1e34899f1ca98f4ca91b04fc3b29c819ded63df5fc382f63566d723bc3f93e2d4314d8ee3d7e6ba71b3aa05d02eac6248fc118d667358fa5fd67db1
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
XKAHEZZHLYETQDGK.bat
-
Size
1KB
-
MD5
20b2afea9d76846c78a9e7588a7135e9
-
SHA1
f307dca000a50208201c49324206bb6954fea3b3
-
SHA256
9f7fc00e72e44ebc9b9f4b66bbf7d35a6eb6736f00a1ffd56100b6ea2ae57a74
-
SHA512
917d6c18f14d65563c63e7e7b1ea7913a7767f855e94ac0866ae02c268b8c03793876dec92d23789b9e055743964a1471a63e28130621675a3249c4cfd227726
Score8/10 -
-
-
Target
YEJVMCIJLIUXHSQV.ps1
-
Size
553B
-
MD5
0bc179668af7ed0a345b1c1a998c186c
-
SHA1
6b0c0e6f39c14dc0eb0be24b5db35a41ef8ff777
-
SHA256
97c1c775cb48d543ec26c75c7b936a5072619427eba9a8518ac32d2a94a321df
-
SHA512
163db9b801b350fee45eaa75156129641b25fb9f5281cacad97d6df6a142789171cda0c337ea0f8c5c943ff6e7e001f0db0ff3f4fcd8e0b005c0f0870133bfb8
Score3/10 -