General
-
Target
normal.exe
-
Size
45KB
-
Sample
240629-nkrh7swgqh
-
MD5
24de871a8fa5bc8a878ae2b76ccf7081
-
SHA1
c31b38ed40a3e89d2c156851740cf50c6b42441e
-
SHA256
659a6386bb99408c651bbadc023de111e967f887c92e66f83d38208f8eee3afc
-
SHA512
9bfad714aa138a4de3c568540ae07ea65c57f4230748d74561a18dc125de1e47bb1fa27c4fb30b1d52d554e240c48435e60d2c46989453fffa8fe1930195e859
-
SSDEEP
768:yu1a71T3EiJfWUzDydmo2qzh58SIkOPILzjb5gs3i+uROUHVnloBDZ7x:yu1a71T3xq2sNF3L3bWsS+yHVlOd7x
Behavioral task
behavioral1
Sample
normal.exe
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
normal.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
asyncrat
0.5.8
Default
dzacwFnyvZFC
-
delay
3
-
install
true
-
install_file
update.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/K16mDJV5
Targets
-
-
Target
normal.exe
-
Size
45KB
-
MD5
24de871a8fa5bc8a878ae2b76ccf7081
-
SHA1
c31b38ed40a3e89d2c156851740cf50c6b42441e
-
SHA256
659a6386bb99408c651bbadc023de111e967f887c92e66f83d38208f8eee3afc
-
SHA512
9bfad714aa138a4de3c568540ae07ea65c57f4230748d74561a18dc125de1e47bb1fa27c4fb30b1d52d554e240c48435e60d2c46989453fffa8fe1930195e859
-
SSDEEP
768:yu1a71T3EiJfWUzDydmo2qzh58SIkOPILzjb5gs3i+uROUHVnloBDZ7x:yu1a71T3xq2sNF3L3bWsS+yHVlOd7x
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-