General
-
Target
XBinderOutput.exe
-
Size
64KB
-
Sample
241127-vvnzdsspdt
-
MD5
7ca5852a9d6d8c6d86ed1d0c0814a9f6
-
SHA1
692ef8e9600163e66508dd27cbbded5be2f9dda5
-
SHA256
92ec5fd1a2c0aa1c565b93b5c2f8d9e472346014a0927182865b7c830aa3c7cd
-
SHA512
3fb5c4a95b6c1fb4db20810d824192aa8b4dc35535151eaad02a60e0a24df38e452d52a8912fb8d114d7d0d58456763cf3eb739086fdb72f838f235e88f877b8
-
SSDEEP
1536:YzUmkjlbRxKrE99uExdTlM28i5pzDwl2qay:e50lb7KrE93Mw7wl2S
Static task
static1
Behavioral task
behavioral1
Sample
XBinderOutput.exe
Resource
win7-20240729-en
Malware Config
Extracted
asyncrat
Default
one-accordance.gl.at.ply.gg:9590
-
delay
1
-
install
true
-
install_file
Windows Defender.exe
-
install_folder
%AppData%
Extracted
asyncrat
0.5.8
Default
66.66.146.74:9511
nwJFeGdDXcL2
-
delay
3
-
install
true
-
install_file
System32.exe
-
install_folder
%AppData%
Targets
-
-
Target
XBinderOutput.exe
-
Size
64KB
-
MD5
7ca5852a9d6d8c6d86ed1d0c0814a9f6
-
SHA1
692ef8e9600163e66508dd27cbbded5be2f9dda5
-
SHA256
92ec5fd1a2c0aa1c565b93b5c2f8d9e472346014a0927182865b7c830aa3c7cd
-
SHA512
3fb5c4a95b6c1fb4db20810d824192aa8b4dc35535151eaad02a60e0a24df38e452d52a8912fb8d114d7d0d58456763cf3eb739086fdb72f838f235e88f877b8
-
SSDEEP
1536:YzUmkjlbRxKrE99uExdTlM28i5pzDwl2qay:e50lb7KrE93Mw7wl2S
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-