General
-
Target
5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
-
Size
4.2MB
-
Sample
221009-gqwa1sgde6
-
MD5
45177df44d074eee7a644ff06bdbf462
-
SHA1
4dcdb661bb99370beea4423e71ec322e8d13a0d0
-
SHA256
5e8c61b17135bc249ad576d94d4ab70f0c8e4b87fb13181d2ba6b56750d897f4
-
SHA512
46abe4164981147ab64c2c860c5887a181f060964c16fdc8e8f5d5b89f7f4459098a29381234595142dccd21883fc89fca4dddc97304d963f0d1809584a1fa34
-
SSDEEP
98304:tD4WgEZwKnxnA5OCdJR3xLzgI8IP7lSkQuIXFtN:eW3wKnxnaR3F0I8IPZSkQuIX/
Static task
static1
Behavioral task
behavioral1
Sample
5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
asyncrat
0.5.6D
Default
milla.publicvm.com:6606
milla.publicvm.com:7707
milla.publicvm.com:8808
hzizmtfuyizxxugkf
-
delay
40
-
install
true
-
install_file
cclaner.exe
-
install_folder
%AppData%
Targets
-
-
Target
5E8C61B17135BC249AD576D94D4AB70F0C8E4B87FB131.exe
-
Size
4.2MB
-
MD5
45177df44d074eee7a644ff06bdbf462
-
SHA1
4dcdb661bb99370beea4423e71ec322e8d13a0d0
-
SHA256
5e8c61b17135bc249ad576d94d4ab70f0c8e4b87fb13181d2ba6b56750d897f4
-
SHA512
46abe4164981147ab64c2c860c5887a181f060964c16fdc8e8f5d5b89f7f4459098a29381234595142dccd21883fc89fca4dddc97304d963f0d1809584a1fa34
-
SSDEEP
98304:tD4WgEZwKnxnA5OCdJR3xLzgI8IP7lSkQuIXFtN:eW3wKnxnaR3F0I8IPZSkQuIX/
-
Async RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-