General
-
Target
1100-57-0x0000000000720000-0x0000000000732000-memory.dmp
-
Size
72KB
-
Sample
230226-y1f3hsab97
-
MD5
7d480b7a3476531910b9168f2e418ab2
-
SHA1
ab72965b12f1758bda40e765fb98b2af3bb7716e
-
SHA256
223b2831c7155056d482196ea796444f11e409d37846de9a721f55152f125c6e
-
SHA512
5e46ec8f0c8847b56ab8d24621c2d0dfdb495f4cd8a118ba6c59fab6faf8700c1fd6b8a4bd8a7d480ca376ab4f1ccf5c41cdd331576fb82edf33bd10fcf1b331
-
SSDEEP
768:4oXyvMOgs2/W4G9mxNruDi/yC5pyjbzgr2ixxdwffK1rLVTClZF2tYcFmVc6KR:4oX4MOg/0+Xpebsr/HzWrFKmVclR
Behavioral task
behavioral1
Sample
1100-57-0x0000000000720000-0x0000000000732000-memory.exe
Resource
win7-20230220-en
Malware Config
Extracted
asyncrat
0.5.6D
Default
milla.publicvm.com:6606
milla.publicvm.com:7707
milla.publicvm.com:8808
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
wsqhardwkhsrdsfqi
-
delay
7
-
install
true
-
install_file
taskmengar.exe
-
install_folder
%AppData%
Targets
-
-
Target
1100-57-0x0000000000720000-0x0000000000732000-memory.dmp
-
Size
72KB
-
MD5
7d480b7a3476531910b9168f2e418ab2
-
SHA1
ab72965b12f1758bda40e765fb98b2af3bb7716e
-
SHA256
223b2831c7155056d482196ea796444f11e409d37846de9a721f55152f125c6e
-
SHA512
5e46ec8f0c8847b56ab8d24621c2d0dfdb495f4cd8a118ba6c59fab6faf8700c1fd6b8a4bd8a7d480ca376ab4f1ccf5c41cdd331576fb82edf33bd10fcf1b331
-
SSDEEP
768:4oXyvMOgs2/W4G9mxNruDi/yC5pyjbzgr2ixxdwffK1rLVTClZF2tYcFmVc6KR:4oX4MOg/0+Xpebsr/HzWrFKmVclR
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-