General
-
Target
test.exe
-
Size
47KB
-
Sample
240415-xwhj4sga9x
-
MD5
884895e3429b7d9226775d70053e618a
-
SHA1
f03b948e4ec10dbd6f921804235d13b80addc032
-
SHA256
5fab8a82de6210ae1abcc37b7a2c6d1be54da12a4c8c88e347e093b7d88c27a0
-
SHA512
b5d47386044ff0e35fd1f09991449bce1bf7269f6a7660ac4be53eef6adecb7c992936bddd9180b3044a2d40699eb6b9b7567c828c3c03144ad1ce325d6324a1
-
SSDEEP
768:8um8n1TQwtPtWUNt1nmo2qzJlWIRW/aJP+YPIzsWSq0bUcVDNR3Tdzd7cnTrc1v6:8um81TQq72sWn/1dzs3bUcRR3TdzBcTD
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20240221-en
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
90.217.43.208:6606
90.217.43.208:7707
90.217.43.208:8808
48gyxPD2mgXA
-
delay
3
-
install
true
-
install_file
bloxstrap.exe
-
install_folder
%AppData%
Targets
-
-
Target
test.exe
-
Size
47KB
-
MD5
884895e3429b7d9226775d70053e618a
-
SHA1
f03b948e4ec10dbd6f921804235d13b80addc032
-
SHA256
5fab8a82de6210ae1abcc37b7a2c6d1be54da12a4c8c88e347e093b7d88c27a0
-
SHA512
b5d47386044ff0e35fd1f09991449bce1bf7269f6a7660ac4be53eef6adecb7c992936bddd9180b3044a2d40699eb6b9b7567c828c3c03144ad1ce325d6324a1
-
SSDEEP
768:8um8n1TQwtPtWUNt1nmo2qzJlWIRW/aJP+YPIzsWSq0bUcVDNR3Tdzd7cnTrc1v6:8um81TQq72sWn/1dzs3bUcRR3TdzBcTD
-
Detect ZGRat V1
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-