General
-
Target
5178C3D5FB3E9A5CC0AA428226515BAC.exe
-
Size
1.4MB
-
Sample
231206-vqbs9sah49
-
MD5
5178c3d5fb3e9a5cc0aa428226515bac
-
SHA1
1ed781155e6ea6794657101797bf003381ca6d58
-
SHA256
b2c929f7f2d37b9d1e16e8a0e42fb85e6d9cb5cef8d83dc9bac31a102865e612
-
SHA512
f509d79c2f2a84605b607c13ad396c468fe15a459dac87629c8700e34d4aff6c94974d734234a5144e6dfc9d70c0b44d24ba77359654e0cd00e1749dc8b18d37
-
SSDEEP
24576:Ck+0wECvvv+p2zjNgK6dBiEcGwudooFkPhaFN0ACPyoI8IUGiKHT27znAzVbMg1G:JOWp2pkdooUEfCPkOGilzABQe
Static task
static1
Behavioral task
behavioral1
Sample
5178C3D5FB3E9A5CC0AA428226515BAC.exe
Resource
win7-20231023-en
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
ronymahmoud.casacam.net:6606
ronymahmoud.casacam.net:7707
ronymahmoud.casacam.net:8808
imhydkyywihv
-
delay
9
-
install
true
-
install_file
explorrare.exe
-
install_folder
%AppData%
Targets
-
-
Target
5178C3D5FB3E9A5CC0AA428226515BAC.exe
-
Size
1.4MB
-
MD5
5178c3d5fb3e9a5cc0aa428226515bac
-
SHA1
1ed781155e6ea6794657101797bf003381ca6d58
-
SHA256
b2c929f7f2d37b9d1e16e8a0e42fb85e6d9cb5cef8d83dc9bac31a102865e612
-
SHA512
f509d79c2f2a84605b607c13ad396c468fe15a459dac87629c8700e34d4aff6c94974d734234a5144e6dfc9d70c0b44d24ba77359654e0cd00e1749dc8b18d37
-
SSDEEP
24576:Ck+0wECvvv+p2zjNgK6dBiEcGwudooFkPhaFN0ACPyoI8IUGiKHT27znAzVbMg1G:JOWp2pkdooUEfCPkOGilzABQe
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-