General
-
Target
2.ps1
-
Size
1002KB
-
Sample
240803-wq1cas1bmn
-
MD5
53c4c7466cebb3357a4bf5fdde6e03bd
-
SHA1
3ae57e66c6651b2c35b873db5de86b87ccc969ad
-
SHA256
ec7d6975587d8dd4effb5727882b1fbb867766d4df73ec304c88d27362ce6ace
-
SHA512
aa7a49bde2e30748853b66c772d5bc72372699d52a0d4806d373e870eaa0488ba6ff7b92669e15c9b0180f4cfebd45e698a75b514512b6eddb338dfaf2d2a75e
-
SSDEEP
24576:TawjBUo3v/AOhx415r2X0Kin4clpSeuoZ+tF0USjpMmaXBxwP0oOGAlLRqkbx2yY:e
Static task
static1
Behavioral task
behavioral1
Sample
2.ps1
Resource
win7-20240704-en
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
Default
grogrogrogro.ddnsgeek.com:4444
AsyncMutex_6SI8OWDAW
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
2.ps1
-
Size
1002KB
-
MD5
53c4c7466cebb3357a4bf5fdde6e03bd
-
SHA1
3ae57e66c6651b2c35b873db5de86b87ccc969ad
-
SHA256
ec7d6975587d8dd4effb5727882b1fbb867766d4df73ec304c88d27362ce6ace
-
SHA512
aa7a49bde2e30748853b66c772d5bc72372699d52a0d4806d373e870eaa0488ba6ff7b92669e15c9b0180f4cfebd45e698a75b514512b6eddb338dfaf2d2a75e
-
SSDEEP
24576:TawjBUo3v/AOhx415r2X0Kin4clpSeuoZ+tF0USjpMmaXBxwP0oOGAlLRqkbx2yY:e
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-