General
-
Target
flemme.exe
-
Size
112KB
-
Sample
240802-zntnhszcnj
-
MD5
2dd4a3e79a430fcf80e0c16c059c4c2c
-
SHA1
b32b851bb2746acfa2035d6765f7827e5880debb
-
SHA256
5969e616a32e7cb09dd32ddca0c37e989a6131edb5c4a7b4367400c3f0e8527e
-
SHA512
cae7ef83d8eb0f77d018dae6327b46cbb61e68623d64551492f883b9903a00ff410a9bda7c84f4348497e55b34490b315f855b95288e71710076cb246863a6a4
-
SSDEEP
3072:IucJTUUk2QGjf93SybKeYOQpiGU0tFsHEx:IucjNrr9CybEOq5
Behavioral task
behavioral1
Sample
flemme.exe
Resource
win7-20240729-en
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
zou2AAxxuspP
-
delay
3
-
install
true
-
install_file
executorroblox.exe
-
install_folder
%AppData%
Targets
-
-
Target
flemme.exe
-
Size
112KB
-
MD5
2dd4a3e79a430fcf80e0c16c059c4c2c
-
SHA1
b32b851bb2746acfa2035d6765f7827e5880debb
-
SHA256
5969e616a32e7cb09dd32ddca0c37e989a6131edb5c4a7b4367400c3f0e8527e
-
SHA512
cae7ef83d8eb0f77d018dae6327b46cbb61e68623d64551492f883b9903a00ff410a9bda7c84f4348497e55b34490b315f855b95288e71710076cb246863a6a4
-
SSDEEP
3072:IucJTUUk2QGjf93SybKeYOQpiGU0tFsHEx:IucjNrr9CybEOq5
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-