General
-
Target
2024-12-19_03b9fa614f68e3015bc73fb72b9abe41_avoslocker_hijackloader_luca-stealer_rhadamanthys
-
Size
10.0MB
-
Sample
241219-ebyrgsxlej
-
MD5
03b9fa614f68e3015bc73fb72b9abe41
-
SHA1
2a188db911e4005083f4e8ec121435dd78bb485a
-
SHA256
49735d3992131f165199287d0b5997dfa8e035a10177ea556e957d3cac7a1cb4
-
SHA512
2da0f16a883388b0c84ca727eb40eeb1d60703d695e359b6bf16d8b0e43ab44d73acfda9c38343cd948df158017e90754e0f70fcea25cb48ad8c9587c90a56f0
-
SSDEEP
49152:NRr+LfDw1gczio6kW4jxnTs7ArxNWgZQNX:ufsjzi/ijxnTs7QxN2
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-19_03b9fa614f68e3015bc73fb72b9abe41_avoslocker_hijackloader_luca-stealer_rhadamanthys.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-12-19_03b9fa614f68e3015bc73fb72b9abe41_avoslocker_hijackloader_luca-stealer_rhadamanthys.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
asyncrat
1.0.7
29Ago
trackboxing.dynuddns.net:11203
DcRatMutex_q77
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
2024-12-19_03b9fa614f68e3015bc73fb72b9abe41_avoslocker_hijackloader_luca-stealer_rhadamanthys
-
Size
10.0MB
-
MD5
03b9fa614f68e3015bc73fb72b9abe41
-
SHA1
2a188db911e4005083f4e8ec121435dd78bb485a
-
SHA256
49735d3992131f165199287d0b5997dfa8e035a10177ea556e957d3cac7a1cb4
-
SHA512
2da0f16a883388b0c84ca727eb40eeb1d60703d695e359b6bf16d8b0e43ab44d73acfda9c38343cd948df158017e90754e0f70fcea25cb48ad8c9587c90a56f0
-
SSDEEP
49152:NRr+LfDw1gczio6kW4jxnTs7ArxNWgZQNX:ufsjzi/ijxnTs7QxN2
Score10/10-
Asyncrat family
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-