General
-
Target
ada59bb47c3eacd106c6a9dfa31405ed3396ed8703fa4617d766ed29bcafc92f
-
Size
441KB
-
Sample
250107-c1jmraskcq
-
MD5
ef30cabd2b8df639793516fa10ca470b
-
SHA1
df15493f5ed787bcad3e7847abe572f8b9c244c7
-
SHA256
ada59bb47c3eacd106c6a9dfa31405ed3396ed8703fa4617d766ed29bcafc92f
-
SHA512
d7282571026e0052d56efb4ad92c1239b74d6f06d9e58361039668249073f8fa14e43377dfd86c825d5898b010b422d59fb94033c57cf14b25cffc4084017097
-
SSDEEP
6144:7U7/Q+2VS3wsUxBn2GPXa99gG1mYuglVEcWR/sJtsRJ91BEQwp+ZucgfaawnuCT:7UU+6xBn2GPX29HmYn3EcSNRBEvwTBPF
Static task
static1
Behavioral task
behavioral1
Sample
Order Delivery- 1.6.2025.exe
Resource
win7-20241023-en
Malware Config
Extracted
asyncrat
0.5.7B
Default01
93.123.109.235:8747
93.123.109.235:7477
woolingbrin.systes.net:8747
woolingbrin.systes.net:7477
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
cicj.exe
-
install_folder
%Temp%
Targets
-
-
Target
Order Delivery- 1.6.2025.exe
-
Size
634KB
-
MD5
638945b4208abc0bc7126657454a4e03
-
SHA1
8dc353e3834325e94f3bcf1c28d0763af5183336
-
SHA256
0265bce453d46f747901b0cc32367afc17ca79c5ab05d55b66ed58c99680fc95
-
SHA512
382b9ecd098154fc638870b901d54c659c02e3c2c92ea90bfa82080052e2c7095b76315cf3f63250d9bfdaeb4d1356123beac069553f37a845cd42296b5b3509
-
SSDEEP
12288:VcrNS33L10QdrXPdlM/nQPe6cS1RBEp2LBoK:INA3R5drXPU/QPp71RB62LaK
-
Asyncrat family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-