General
-
Target
XBinderOutput.sfx.exe
-
Size
499KB
-
Sample
241028-ylnh2swbmb
-
MD5
5c977d094b94db0269b312c4af478251
-
SHA1
bcb158d47179c6c6016472a10266a690241bb3e9
-
SHA256
94459beb2e87d21c9360d5128286e9b3e9e53a0b45e73dca3746ce32edc513d1
-
SHA512
56292c087f0cc6ec92bace134f8e8fe23bbce4b3392ec92fbce4d773c9d5dc9b0a4d0b827fa89528aedc7eb1675a7ecc01bf3cb5f02b38abec348c5f77f5b478
-
SSDEEP
12288:yyveQB/fTHIGaPkKEYzURNAwbAgOT+t1RRC7:yuDXTIGaPhEYzUzA0bRi
Static task
static1
Behavioral task
behavioral1
Sample
XBinderOutput.sfx.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
XBinderOutput.sfx.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
asyncrat
1.0.7
Test
5.tcp.eu.ngrok.io:19854
DcRatMutex_adlzxvdama
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
XBinderOutput.sfx.exe
-
Size
499KB
-
MD5
5c977d094b94db0269b312c4af478251
-
SHA1
bcb158d47179c6c6016472a10266a690241bb3e9
-
SHA256
94459beb2e87d21c9360d5128286e9b3e9e53a0b45e73dca3746ce32edc513d1
-
SHA512
56292c087f0cc6ec92bace134f8e8fe23bbce4b3392ec92fbce4d773c9d5dc9b0a4d0b827fa89528aedc7eb1675a7ecc01bf3cb5f02b38abec348c5f77f5b478
-
SSDEEP
12288:yyveQB/fTHIGaPkKEYzURNAwbAgOT+t1RRC7:yuDXTIGaPhEYzUzA0bRi
Score10/10-
Asyncrat family
-
Async RAT payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-