General
-
Target
cum.exe
-
Size
45KB
-
Sample
240616-ssshpaybqc
-
MD5
910e4d86c5f28a323866c143789749db
-
SHA1
f8403807b7eb02a4a4021675c7a3d4aefc975527
-
SHA256
97ef8ed044f3e29f2d56193a52aa607e33eb990210cea4cdac6fbf7285fc733d
-
SHA512
8c577c27c82f7c75ca8abf8879463e86917a077e39d45a720bbd84d670f82c41b61041c99b22d3bc6738c42260a9ca0e8e6c65c1f93eafd5a529ce26dd31ebe9
-
SSDEEP
768:Ru6+dT9slTJWUhDuzmo2qLB6wnu+pPc2NLPIbzjbdgM3iEXd7KYtl+cBDZTx:Ru6+dT9We2C6Z0c2Cb3bKMSEXd1tg6dN
Malware Config
Extracted
asyncrat
0.5.8
Default
172.16.0.64:6606
172.16.0.64:7707
172.16.0.64:8808
10.6.0.86:6606
10.6.0.86:7707
10.6.0.86:8808
192.168.0.118:6606
192.168.0.118:7707
192.168.0.118:8808
2402:800:7b1a:eaba:70c1:3e51:c15b:59f2:6606
2402:800:7b1a:eaba:70c1:3e51:c15b:59f2:7707
2402:800:7b1a:eaba:70c1:3e51:c15b:59f2:8808
PsPcV02re3Ma
-
delay
3
-
install
true
-
install_file
RAR.exe
-
install_folder
%AppData%
Targets
-
-
Target
cum.exe
-
Size
45KB
-
MD5
910e4d86c5f28a323866c143789749db
-
SHA1
f8403807b7eb02a4a4021675c7a3d4aefc975527
-
SHA256
97ef8ed044f3e29f2d56193a52aa607e33eb990210cea4cdac6fbf7285fc733d
-
SHA512
8c577c27c82f7c75ca8abf8879463e86917a077e39d45a720bbd84d670f82c41b61041c99b22d3bc6738c42260a9ca0e8e6c65c1f93eafd5a529ce26dd31ebe9
-
SSDEEP
768:Ru6+dT9slTJWUhDuzmo2qLB6wnu+pPc2NLPIbzjbdgM3iEXd7KYtl+cBDZTx:Ru6+dT9We2C6Z0c2Cb3bKMSEXd1tg6dN
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-