General
-
Target
client.exe
-
Size
45KB
-
Sample
230529-np1yfaca7y
-
MD5
c48d9ae8350765db9605c776576c40bd
-
SHA1
547db0270dd85d7a779f0d3e468cef6b899291af
-
SHA256
5ce48e0a279b4497675a807b0aed3c3cc11acc68507bdcdce2577280d42131a8
-
SHA512
c897072ca1ce04783aed04d7cef9422e7a46c5ec9062f234e95e15e03acc9a50aefdbf5be01fe69789610142a8b2db58da40891232662a11911f1269698350ce
-
SSDEEP
768:/uyCNTAoZjRWUJs9bmo2qL9KEbHORtOPIMJzjbZgX3ipfodwsclmKT421BDZix:/uyCNTAGo2I323MJ3b2XSpAC7bdix
Behavioral task
behavioral1
Sample
client.exe
Resource
win7-20230220-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
xrxservices
-
delay
3
-
install
true
-
install_file
service.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/XHZ7Z0gA
Targets
-
-
Target
client.exe
-
Size
45KB
-
MD5
c48d9ae8350765db9605c776576c40bd
-
SHA1
547db0270dd85d7a779f0d3e468cef6b899291af
-
SHA256
5ce48e0a279b4497675a807b0aed3c3cc11acc68507bdcdce2577280d42131a8
-
SHA512
c897072ca1ce04783aed04d7cef9422e7a46c5ec9062f234e95e15e03acc9a50aefdbf5be01fe69789610142a8b2db58da40891232662a11911f1269698350ce
-
SSDEEP
768:/uyCNTAoZjRWUJs9bmo2qL9KEbHORtOPIMJzjbZgX3ipfodwsclmKT421BDZix:/uyCNTAGo2I323MJ3b2XSpAC7bdix
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-