General
-
Target
198886528a13c0f7f03536bac4a5c449d3b21131887efa7595c9e9a56a2cfc0e
-
Size
45KB
-
Sample
221205-v59zlsec2s
-
MD5
f559c085934e6e7d98e6d520684196eb
-
SHA1
3a829e2faeaa5a48556770cc159a4e291a91a9c3
-
SHA256
198886528a13c0f7f03536bac4a5c449d3b21131887efa7595c9e9a56a2cfc0e
-
SHA512
7451ae89f1df93613069ea4056d9f23b1d8c71636487ee888b39e7887181b03c2f7183673468ead5fec2d0c50396b6545a623e6627a88f0268a68bab47d67f79
-
SSDEEP
768:SubrdT5UohzWUfpdBmo2qV6KjGKG6PIyzjbFgX3iUqaPkMapBDZHx:SubrdT5Pf2FKYDy3bCXSUqQE3dHx
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:51115
127.0.0.1:26993
127.0.0.1:19624
185.246.220.26:6606
185.246.220.26:7707
185.246.220.26:8808
185.246.220.26:51115
185.246.220.26:26993
185.246.220.26:19624
5.tcp.ngrok.io:6606
5.tcp.ngrok.io:7707
5.tcp.ngrok.io:8808
5.tcp.ngrok.io:51115
5.tcp.ngrok.io:26993
5.tcp.ngrok.io:19624
disownnet.duckdns.org:6606
disownnet.duckdns.org:7707
disownnet.duckdns.org:8808
disownnet.duckdns.org:51115
disownnet.duckdns.org:26993
disownnet.duckdns.org:19624
7.tcp.eu.ngrok.io:6606
7.tcp.eu.ngrok.io:7707
7.tcp.eu.ngrok.io:8808
7.tcp.eu.ngrok.io:51115
7.tcp.eu.ngrok.io:26993
7.tcp.eu.ngrok.io:19624
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
services.exe
-
install_folder
%AppData%
Targets
-
-
Target
198886528a13c0f7f03536bac4a5c449d3b21131887efa7595c9e9a56a2cfc0e
-
Size
45KB
-
MD5
f559c085934e6e7d98e6d520684196eb
-
SHA1
3a829e2faeaa5a48556770cc159a4e291a91a9c3
-
SHA256
198886528a13c0f7f03536bac4a5c449d3b21131887efa7595c9e9a56a2cfc0e
-
SHA512
7451ae89f1df93613069ea4056d9f23b1d8c71636487ee888b39e7887181b03c2f7183673468ead5fec2d0c50396b6545a623e6627a88f0268a68bab47d67f79
-
SSDEEP
768:SubrdT5UohzWUfpdBmo2qV6KjGKG6PIyzjbFgX3iUqaPkMapBDZHx:SubrdT5Pf2FKYDy3bCXSUqQE3dHx
-
Async RAT payload
-