General
-
Target
ZenoExecutor V1 Installer.exe
-
Size
98KB
-
Sample
240521-vrzaysce87
-
MD5
a721d3863b188dbb51d95dcb2d963a44
-
SHA1
a0ed4f31f78e9b903719b9d788995ba2f830655a
-
SHA256
0732ec5e0f81b1125c1c5490b25b6b24c55e21b6e16c2d392050c422855da071
-
SHA512
424c11fd5f1e022ae8b2758fa3dd8f0050393bffb36d66de89dd5973ef960f3e33ab183b6083d3948c3a9098afaaba5c68fab37306f5a2902167f00a2084221a
-
SSDEEP
3072:hu6FTv2S2q5f3INgibu+HHwJOYprr8jDNSgOEHaZXTJ5x:hu6UfoGgib1HMr8jDUgxQXR
Behavioral task
behavioral1
Sample
ZenoExecutor V1 Installer.exe
Resource
win7-20240221-en
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:1337
192.168.1.11:1337
90.240.254.189:1337
NDO9pZJr6iLD
-
delay
3
-
install
true
-
install_file
Security.exe
-
install_folder
%AppData%
Targets
-
-
Target
ZenoExecutor V1 Installer.exe
-
Size
98KB
-
MD5
a721d3863b188dbb51d95dcb2d963a44
-
SHA1
a0ed4f31f78e9b903719b9d788995ba2f830655a
-
SHA256
0732ec5e0f81b1125c1c5490b25b6b24c55e21b6e16c2d392050c422855da071
-
SHA512
424c11fd5f1e022ae8b2758fa3dd8f0050393bffb36d66de89dd5973ef960f3e33ab183b6083d3948c3a9098afaaba5c68fab37306f5a2902167f00a2084221a
-
SSDEEP
3072:hu6FTv2S2q5f3INgibu+HHwJOYprr8jDNSgOEHaZXTJ5x:hu6UfoGgib1HMr8jDUgxQXR
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-