General
-
Target
1680-3-0x0000000000510000-0x0000000000522000-memory.dmp
-
Size
72KB
-
Sample
231206-vs48laff91
-
MD5
0760ccf06513794ba0a457234bd63529
-
SHA1
362a9b3eadf2746b7b63d4b1159107e15a08ef5d
-
SHA256
a46c34060509e0bc0bafcda594ffadc4b236426cd94ca6950b2b4d10e9f29fed
-
SHA512
d512fafb812d7b636e176a1ad438fe2a492455391dd785b0f2e7f1d0d32045c0111af74278c00dc4b4f2330d5cf3a58bdbded9dd6688bf6fd988987aee6ed2a6
-
SSDEEP
768:Qov5MNNmnO4Gl2CN8wG8yU5CFbjbRgr3iEZ9PKAClZN2tYcFmVc6K:Qov5MNQDXUEPberSQWrNKmVcl
Behavioral task
behavioral1
Sample
1680-3-0x0000000000510000-0x0000000000522000-memory.exe
Resource
win7-20231129-en
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
ronymahmoud.casacam.net:6606
ronymahmoud.casacam.net:7707
ronymahmoud.casacam.net:8808
imhydkyywihv
-
delay
9
-
install
true
-
install_file
explorrare.exe
-
install_folder
%AppData%
Targets
-
-
Target
1680-3-0x0000000000510000-0x0000000000522000-memory.dmp
-
Size
72KB
-
MD5
0760ccf06513794ba0a457234bd63529
-
SHA1
362a9b3eadf2746b7b63d4b1159107e15a08ef5d
-
SHA256
a46c34060509e0bc0bafcda594ffadc4b236426cd94ca6950b2b4d10e9f29fed
-
SHA512
d512fafb812d7b636e176a1ad438fe2a492455391dd785b0f2e7f1d0d32045c0111af74278c00dc4b4f2330d5cf3a58bdbded9dd6688bf6fd988987aee6ed2a6
-
SSDEEP
768:Qov5MNNmnO4Gl2CN8wG8yU5CFbjbRgr3iEZ9PKAClZN2tYcFmVc6K:Qov5MNQDXUEPberSQWrNKmVcl
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-