General
-
Target
test.zip
-
Size
928KB
-
Sample
241024-s3wm4a1eme
-
MD5
e003f20b316a5eb35416f12d0531ae0e
-
SHA1
40c74eb990a2441dc4bf576bd690dbe6c022dc5a
-
SHA256
1406d358c5ebb28780323b6451363d1f0f6ab5738f3924a6434622991f6fb2f0
-
SHA512
3becac05a784cf8aad1a5294005a88ffe7e9c0fbe4a87438b94611e8160700ebadf30a85bbc383d56a5e1710c775c1eb2ccfd43a6ed521e71393f8523564774a
-
SSDEEP
24576:yfI7FbTmxwx4KJukcG7BYOCsi4JuITyaoES:nxbTHsk57BYCnItES
Static task
static1
Behavioral task
behavioral1
Sample
test.zip
Resource
win10v2004-20241007-en
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
zhitler2
hitler55.dvrdns.org:555
hitler55.dvrdns.org:5555
hitler55.dvrdns.org:6666
hitler55.dyndns.org:555
hitler55.dyndns.org:5555
hitler55.dyndns.org:6666
hitler0077.linkpc.net:555
hitler0077.linkpc.net:5555
hitler0077.linkpc.net:6666
AsyncMutex_zhitler2
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
test.zip
-
Size
928KB
-
MD5
e003f20b316a5eb35416f12d0531ae0e
-
SHA1
40c74eb990a2441dc4bf576bd690dbe6c022dc5a
-
SHA256
1406d358c5ebb28780323b6451363d1f0f6ab5738f3924a6434622991f6fb2f0
-
SHA512
3becac05a784cf8aad1a5294005a88ffe7e9c0fbe4a87438b94611e8160700ebadf30a85bbc383d56a5e1710c775c1eb2ccfd43a6ed521e71393f8523564774a
-
SSDEEP
24576:yfI7FbTmxwx4KJukcG7BYOCsi4JuITyaoES:nxbTHsk57BYCnItES
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-