General
-
Target
TF814BG.TBZ2
-
Size
8.6MB
-
Sample
241023-2scxnsvgrr
-
MD5
531993262de095bb38e55e9f317ef408
-
SHA1
be17b17da93d42ff349a71c7a5de230aad37f2e0
-
SHA256
8cac130cafde6f93de3f1b09de9c223d88da8a565de6755b03548a9f76bb5147
-
SHA512
8648440226181b3bfb7f25feb6b30d4e93f1712ff27ec0f89ebedca818f9c2dbf9c5c8d8495ba38e0e6711276c54e046cd9e3a4fcd82e530a2def393555cae84
-
SSDEEP
196608:Xmef1wvzRjnx/izRU91VqIhfmRF6CGMdkbKFcFXzClIg2SSqx1XmttX:b18Bnx/itGGzGMdW4Ig2p62ttX
Static task
static1
Behavioral task
behavioral1
Sample
TF814BG.zip
Resource
win7-20240903-es
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Default
envio122344.duckdns.org:3030
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
TF814BG.TBZ2
-
Size
8.6MB
-
MD5
531993262de095bb38e55e9f317ef408
-
SHA1
be17b17da93d42ff349a71c7a5de230aad37f2e0
-
SHA256
8cac130cafde6f93de3f1b09de9c223d88da8a565de6755b03548a9f76bb5147
-
SHA512
8648440226181b3bfb7f25feb6b30d4e93f1712ff27ec0f89ebedca818f9c2dbf9c5c8d8495ba38e0e6711276c54e046cd9e3a4fcd82e530a2def393555cae84
-
SSDEEP
196608:Xmef1wvzRjnx/izRU91VqIhfmRF6CGMdkbKFcFXzClIg2SSqx1XmttX:b18Bnx/itGGzGMdW4Ig2p62ttX
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Suspicious use of SetThreadContext
-