General
-
Target
9a9a814dc369a5b2318968dbe037d3281dde50b28de210dabf07505077e2c45a.exe
-
Size
4.1MB
-
Sample
240726-fbx1mazfne
-
MD5
015eaec62e39a031067323544f56a5cf
-
SHA1
f36587ba44c4feec2137aa6768719a1281ed0ba8
-
SHA256
9a9a814dc369a5b2318968dbe037d3281dde50b28de210dabf07505077e2c45a
-
SHA512
2da3ff84055021591fc6a7dbcb46a4fbd927aa6ae38da43d8d0620391aef8df3ae0a2edc8305c7720f8e6f0598bd8fe11e8b75b97421eace84365dd405d5de64
-
SSDEEP
49152:VyO1MDMUZNRz1YgO8jXpF4qQqET6JnxgFxMhx3x3gB++xG:YNRrFoDuwg0G
Static task
static1
Behavioral task
behavioral1
Sample
9a9a814dc369a5b2318968dbe037d3281dde50b28de210dabf07505077e2c45a.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9a9a814dc369a5b2318968dbe037d3281dde50b28de210dabf07505077e2c45a.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
asyncrat
2.0.0
Default
webwhatsapp.cc:65503
ShiningForceRatMutex_cs_cs_cs
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
9a9a814dc369a5b2318968dbe037d3281dde50b28de210dabf07505077e2c45a.exe
-
Size
4.1MB
-
MD5
015eaec62e39a031067323544f56a5cf
-
SHA1
f36587ba44c4feec2137aa6768719a1281ed0ba8
-
SHA256
9a9a814dc369a5b2318968dbe037d3281dde50b28de210dabf07505077e2c45a
-
SHA512
2da3ff84055021591fc6a7dbcb46a4fbd927aa6ae38da43d8d0620391aef8df3ae0a2edc8305c7720f8e6f0598bd8fe11e8b75b97421eace84365dd405d5de64
-
SSDEEP
49152:VyO1MDMUZNRz1YgO8jXpF4qQqET6JnxgFxMhx3x3gB++xG:YNRrFoDuwg0G
Score10/10-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1