General
-
Target
561d4930d5ff9d53ffbee68d2554f89ed3b32968ee29b2520ce1f60c5a0d4ff2
-
Size
45KB
-
Sample
220521-pmlamsagek
-
MD5
708b15fe967de91ec55bfc6fdd54433b
-
SHA1
7ce54db6b7a46e78a1fa78b9588c78e1ca2bc904
-
SHA256
561d4930d5ff9d53ffbee68d2554f89ed3b32968ee29b2520ce1f60c5a0d4ff2
-
SHA512
e84b7003094dc40eb025fe44175571d3665dc00d844c574db97f48aceb8cfd2af5bedaf58ffb66d97e694fb6bf5b9e15d07221a115e113f2e467dd3bfd043c2f
Behavioral task
behavioral1
Sample
561d4930d5ff9d53ffbee68d2554f89ed3b32968ee29b2520ce1f60c5a0d4ff2.exe
Resource
win7-20220414-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:8574
lowkeyjust.ddns.net:6606
lowkeyjust.ddns.net:7707
lowkeyjust.ddns.net:8808
lowkeyjust.ddns.net:8574
AsyncMutex_6SI8OkPnk
-
delay
12
-
install
true
-
install_file
SteamStartupService.exe
-
install_folder
%AppData%
Targets
-
-
Target
561d4930d5ff9d53ffbee68d2554f89ed3b32968ee29b2520ce1f60c5a0d4ff2
-
Size
45KB
-
MD5
708b15fe967de91ec55bfc6fdd54433b
-
SHA1
7ce54db6b7a46e78a1fa78b9588c78e1ca2bc904
-
SHA256
561d4930d5ff9d53ffbee68d2554f89ed3b32968ee29b2520ce1f60c5a0d4ff2
-
SHA512
e84b7003094dc40eb025fe44175571d3665dc00d844c574db97f48aceb8cfd2af5bedaf58ffb66d97e694fb6bf5b9e15d07221a115e113f2e467dd3bfd043c2f
-
Async RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-