General
-
Target
55394ffc99ace9a97d0c529a2be317c0N.exe
-
Size
47KB
-
Sample
240803-fzlx9syhje
-
MD5
55394ffc99ace9a97d0c529a2be317c0
-
SHA1
0427b719d52fa112112e3b8001cf2fb5a69c5798
-
SHA256
92847b5aee61516d9a8469dfe9b9d05692834f9f2da8ade00b2cc0721c8a217b
-
SHA512
e5fe23e7e6e699a1e45578c1ce5170651dac33b7b17596a89845a29b1dd732665c8a08c070b959d5ff473d91de3ca84f4adc498f051d5452223b27731d32ce6e
-
SSDEEP
768:AuIndTsErkZTWU/lPhmo2qbJKLKsrcDo117iPINEwf8P6H61fitbRU2pDV8dHwya:AuIndTsXB2OKL3Go1pNEwks2WbRvDx+4
Behavioral task
behavioral1
Sample
55394ffc99ace9a97d0c529a2be317c0N.exe
Resource
win7-20240708-en
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:8000
127.0.0.1:11735
0.tcp.eu.ngrok.io:11735:6606
0.tcp.eu.ngrok.io:11735:7707
0.tcp.eu.ngrok.io:11735:8808
0.tcp.eu.ngrok.io:11735:8000
0.tcp.eu.ngrok.io:11735:11735
H3X4yAaCJZBT
-
delay
6
-
install
true
-
install_file
test.exe
-
install_folder
%AppData%
Targets
-
-
Target
55394ffc99ace9a97d0c529a2be317c0N.exe
-
Size
47KB
-
MD5
55394ffc99ace9a97d0c529a2be317c0
-
SHA1
0427b719d52fa112112e3b8001cf2fb5a69c5798
-
SHA256
92847b5aee61516d9a8469dfe9b9d05692834f9f2da8ade00b2cc0721c8a217b
-
SHA512
e5fe23e7e6e699a1e45578c1ce5170651dac33b7b17596a89845a29b1dd732665c8a08c070b959d5ff473d91de3ca84f4adc498f051d5452223b27731d32ce6e
-
SSDEEP
768:AuIndTsErkZTWU/lPhmo2qbJKLKsrcDo117iPINEwf8P6H61fitbRU2pDV8dHwya:AuIndTsXB2OKL3Go1pNEwks2WbRvDx+4
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-