General
-
Target
shellcode_loader.exe
-
Size
1.7MB
-
Sample
250412-1rpdmsssfw
-
MD5
d4fe738d7991a00669410578b9eb7ca9
-
SHA1
d4d1f3eb846d735b0679144d355c3daf2e8467e1
-
SHA256
d5d261f32c317717df4289fc4d6c5d2155b3c4d545fbd7e55cd24152f35042da
-
SHA512
b97888483aafa8f640caabb500ae445cf891deedb6f60b2c52c8905eb2cdd6f715c33ac2444fba3460f7444453777724d25c581b071a9e702e85b28e22ddd838
-
SSDEEP
49152:HKayovwasyyNGbfFd+vCRVNDzAv7G/VlCm4IU6i:aYmAvH+
Static task
static1
Malware Config
Extracted
asyncrat
L838 RAT v1.0.0
Default
sfsafqagbiv
-
delay
1
-
install
true
-
install_file
Runtime Broker.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/rVJQPNVe
Targets
-
-
Target
shellcode_loader.exe
-
Size
1.7MB
-
MD5
d4fe738d7991a00669410578b9eb7ca9
-
SHA1
d4d1f3eb846d735b0679144d355c3daf2e8467e1
-
SHA256
d5d261f32c317717df4289fc4d6c5d2155b3c4d545fbd7e55cd24152f35042da
-
SHA512
b97888483aafa8f640caabb500ae445cf891deedb6f60b2c52c8905eb2cdd6f715c33ac2444fba3460f7444453777724d25c581b071a9e702e85b28e22ddd838
-
SSDEEP
49152:HKayovwasyyNGbfFd+vCRVNDzAv7G/VlCm4IU6i:aYmAvH+
-
Asyncrat family
-
Venomrat family
-
Async RAT payload
-
Legitimate hosting services abused for malware hosting/C2
-