General
-
Target
dub.bat
-
Size
226KB
-
Sample
230208-ed9a1age4v
-
MD5
cf81b345541f19ab200b4d0de4a64962
-
SHA1
56dcdd340cb470fcd42c0cd1531d1eac8fcd7980
-
SHA256
07a0759d5b376fc57f2ad9c5a32d59829934828b862591225c43421044ffd4ec
-
SHA512
ac960f497fc3354831a76c1a385e95c65b66d862bd09e24b73bedb8e969d8221516e8d7a6eba257c5613c61d82d16305fd672a5112d441b97e5fefa0d88a7e97
-
SSDEEP
6144:LiEz3MvivRRFAFNmR3QaqnMadPo7lNhkLPUoV:mivRRFsNmwulNeLcoV
Static task
static1
Behavioral task
behavioral1
Sample
dub.bat
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dub.bat
Resource
win10-20220901-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
45.12.253.146:6606
45.12.253.146:7707
45.12.253.146:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
dub.bat
-
Size
226KB
-
MD5
cf81b345541f19ab200b4d0de4a64962
-
SHA1
56dcdd340cb470fcd42c0cd1531d1eac8fcd7980
-
SHA256
07a0759d5b376fc57f2ad9c5a32d59829934828b862591225c43421044ffd4ec
-
SHA512
ac960f497fc3354831a76c1a385e95c65b66d862bd09e24b73bedb8e969d8221516e8d7a6eba257c5613c61d82d16305fd672a5112d441b97e5fefa0d88a7e97
-
SSDEEP
6144:LiEz3MvivRRFAFNmR3QaqnMadPo7lNhkLPUoV:mivRRFsNmwulNeLcoV
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-