General
-
Target
6f1dcc78973a69e59d9c0a532dfacd48c63775c4a2cfa0918d7cd6c38018970e
-
Size
470KB
-
Sample
240120-sxzskacfc3
-
MD5
7b4deb9e63c48c460949a590a1dccf68
-
SHA1
311beb0442cdf2c9c34b13a044e213916a8e23d5
-
SHA256
6f1dcc78973a69e59d9c0a532dfacd48c63775c4a2cfa0918d7cd6c38018970e
-
SHA512
e74877e3a1fb22ffeb338bd522138bf4d58cb0068852a9290fc05e0788054a7233952435bdbb965e5941cf36667cdc81e3e036d7ff404fcce6750940b25a7ca8
-
SSDEEP
12288:0Y6W8BIoE76twShgIQtf3w49HhnFwSwq1elnppa2b/fGgktEjzsBT2vdG4ZKAMzw:rj7Qh4fzFwSNMlnppa2bXhkKDTZyGb99
Behavioral task
behavioral1
Sample
6f1dcc78973a69e59d9c0a532dfacd48c63775c4a2cfa0918d7cd6c38018970e.exe
Resource
win7-20231215-en
Malware Config
Extracted
asyncrat
Venom Pwn3rzs' Edtition v6.0.1
Default
MaLo
-
delay
1
-
install
true
-
install_file
utorrentpro.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/6ZWpxLxd
Targets
-
-
Target
6f1dcc78973a69e59d9c0a532dfacd48c63775c4a2cfa0918d7cd6c38018970e
-
Size
470KB
-
MD5
7b4deb9e63c48c460949a590a1dccf68
-
SHA1
311beb0442cdf2c9c34b13a044e213916a8e23d5
-
SHA256
6f1dcc78973a69e59d9c0a532dfacd48c63775c4a2cfa0918d7cd6c38018970e
-
SHA512
e74877e3a1fb22ffeb338bd522138bf4d58cb0068852a9290fc05e0788054a7233952435bdbb965e5941cf36667cdc81e3e036d7ff404fcce6750940b25a7ca8
-
SSDEEP
12288:0Y6W8BIoE76twShgIQtf3w49HhnFwSwq1elnppa2b/fGgktEjzsBT2vdG4ZKAMzw:rj7Qh4fzFwSNMlnppa2bXhkKDTZyGb99
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-