General
-
Target
installer.exe
-
Size
98KB
-
Sample
240121-g2h5tsfhep
-
MD5
b40a42b2e1828301851e3e5c3dea7e37
-
SHA1
a50cb195a147b6128269d4ddc70d3fffbe26ca24
-
SHA256
5298d86085ee5c4e15d5976b3a44d0b11cd7dbf649aebea86eb88d966f888f8b
-
SHA512
8fc06cf9bd83d4a340e7471f048eb97c174afbaf928b13d11128f933718a40e9eda098d4d8556c693f085b0b9991f68d5fce3875406ab10b65411dc74e399392
-
SSDEEP
1536:Zu2/0TceH216sAwKxbgwDasmath+MVWd1ChiH0hLP+VVVVVVVVVVVVVVVVVVVVVE:Zu2MTceH21XDKxbgYKccTbH0hLNB7
Behavioral task
behavioral1
Sample
installer.exe
Resource
win7-20231215-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
zVSfoZEbUHFY
-
delay
3
-
install
true
-
install_file
explorer.exe
-
install_folder
%AppData%
Targets
-
-
Target
installer.exe
-
Size
98KB
-
MD5
b40a42b2e1828301851e3e5c3dea7e37
-
SHA1
a50cb195a147b6128269d4ddc70d3fffbe26ca24
-
SHA256
5298d86085ee5c4e15d5976b3a44d0b11cd7dbf649aebea86eb88d966f888f8b
-
SHA512
8fc06cf9bd83d4a340e7471f048eb97c174afbaf928b13d11128f933718a40e9eda098d4d8556c693f085b0b9991f68d5fce3875406ab10b65411dc74e399392
-
SSDEEP
1536:Zu2/0TceH216sAwKxbgwDasmath+MVWd1ChiH0hLP+VVVVVVVVVVVVVVVVVVVVVE:Zu2MTceH21XDKxbgYKccTbH0hLNB7
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-