General
-
Target
a514f5618e75e6976b61a2e2ca4f9291.exe
-
Size
1.2MB
-
Sample
221004-jjqhasabam
-
MD5
a514f5618e75e6976b61a2e2ca4f9291
-
SHA1
1f6e5ea09e3617c2113bbf0c854fa9c6ef7dbf8e
-
SHA256
f60bcc6d90d9415a7c3c8beebdeeed867df6681880b10e925cdbc767840793ea
-
SHA512
20ed5d38666461559a5c95321240568b77c7ef3ea5e9f66d61288d0ea6a9a863d35dd44fff4f758a050240d68febf8b38b9de3cee5ccd09509155cad3b85af00
-
SSDEEP
24576:JAOcZe4ecyPEy42o1wW6vjOnFveUkjPV99npuezy71oporah3:jW1y4hY6teUkj9fZe6Gs
Static task
static1
Behavioral task
behavioral1
Sample
a514f5618e75e6976b61a2e2ca4f9291.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a514f5618e75e6976b61a2e2ca4f9291.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
product62.duckdns.org:1905
goodygoody.duckdns.org:1905
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
Windows updater.exe
-
install_folder
%AppData%
Targets
-
-
Target
a514f5618e75e6976b61a2e2ca4f9291.exe
-
Size
1.2MB
-
MD5
a514f5618e75e6976b61a2e2ca4f9291
-
SHA1
1f6e5ea09e3617c2113bbf0c854fa9c6ef7dbf8e
-
SHA256
f60bcc6d90d9415a7c3c8beebdeeed867df6681880b10e925cdbc767840793ea
-
SHA512
20ed5d38666461559a5c95321240568b77c7ef3ea5e9f66d61288d0ea6a9a863d35dd44fff4f758a050240d68febf8b38b9de3cee5ccd09509155cad3b85af00
-
SSDEEP
24576:JAOcZe4ecyPEy42o1wW6vjOnFveUkjPV99npuezy71oporah3:jW1y4hY6teUkj9fZe6Gs
Score10/10-
Async RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-