General
-
Target
MailAcessCheckerbyxRisky.exe
-
Size
10.4MB
-
Sample
240803-lxfalavcqb
-
MD5
0bfe538046352ebb0d7b5fcd50a287ad
-
SHA1
e76a0b5d42648df99604079af74931a333703ef3
-
SHA256
a32ad92bc669d691f17c943761f30ebbdc17e85054595c648d78c1015ffcebb9
-
SHA512
e938f69267ed773f26ec8b7d47d98b127c6f659ef04fde925484a1e755e20b435d61a2d3822274e23db48caaa1574c51ce3cb5c87c8c24109998bb0e0a58bfd2
-
SSDEEP
196608:+6JnRoCYJnksvvcHbMdYWSm2iLRoyru5Q2ZGe/QDbA0SnTbja57K4q6:FPoVJnpqi+6XySReIqHjaQ4q
Behavioral task
behavioral1
Sample
MailAcessCheckerbyxRisky.exe
Resource
win7-20240705-en
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
AsyncMutex_7SI8OkPnk
-
delay
3
-
install
true
-
install_file
ContainerRuntime.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/Kb8rTgY7
Targets
-
-
Target
MailAcessCheckerbyxRisky.exe
-
Size
10.4MB
-
MD5
0bfe538046352ebb0d7b5fcd50a287ad
-
SHA1
e76a0b5d42648df99604079af74931a333703ef3
-
SHA256
a32ad92bc669d691f17c943761f30ebbdc17e85054595c648d78c1015ffcebb9
-
SHA512
e938f69267ed773f26ec8b7d47d98b127c6f659ef04fde925484a1e755e20b435d61a2d3822274e23db48caaa1574c51ce3cb5c87c8c24109998bb0e0a58bfd2
-
SSDEEP
196608:+6JnRoCYJnksvvcHbMdYWSm2iLRoyru5Q2ZGe/QDbA0SnTbja57K4q6:FPoVJnpqi+6XySReIqHjaQ4q
-
Async RAT payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-