General
-
Target
SecuriteInfo.com.Trojan.Siggen18.28071.27685.22234.exe
-
Size
1.3MB
-
Sample
240721-lc2m4azbmm
-
MD5
e60b4a9e303e2defab24d4566a58dddb
-
SHA1
07a47b7e033f4b890a1e0818d6bb947ad9e316a8
-
SHA256
19244b433c67d8caf9e6653ea560c53b7f0b716007cae6b5e95e629c367ba190
-
SHA512
d4b8654a253263f0bf14ee594cad1904c8b4a6fe60b46c3e3585686f66be21c73982a26bd4dceb0da8699a9ae8f34a2a4aa299522003c961a0416d01eeb61008
-
SSDEEP
12288:B70JgEvMTUC/Nqg9t5l7w4VsTpPeViEXOOOOL0OOOOOOOMOvIX+OOOIbOl5OOOO0:QkTUQFtDEE+pGkWovdWXtQyMgw/kR5
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen18.28071.27685.22234.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Siggen18.28071.27685.22234.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
asyncrat
0.5.7B
Aakn1515knAakn1515kn!
-
c2_url_file
http://update-checker-status.cc/OCB-Async.txt
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
SecuriteInfo.com.Trojan.Siggen18.28071.27685.22234.exe
-
Size
1.3MB
-
MD5
e60b4a9e303e2defab24d4566a58dddb
-
SHA1
07a47b7e033f4b890a1e0818d6bb947ad9e316a8
-
SHA256
19244b433c67d8caf9e6653ea560c53b7f0b716007cae6b5e95e629c367ba190
-
SHA512
d4b8654a253263f0bf14ee594cad1904c8b4a6fe60b46c3e3585686f66be21c73982a26bd4dceb0da8699a9ae8f34a2a4aa299522003c961a0416d01eeb61008
-
SSDEEP
12288:B70JgEvMTUC/Nqg9t5l7w4VsTpPeViEXOOOOL0OOOOOOOMOvIX+OOOIbOl5OOOO0:QkTUQFtDEE+pGkWovdWXtQyMgw/kR5
Score10/10-
Modifies WinLogon for persistence
-
Suspicious use of SetThreadContext
-