General
-
Target
sasa.bat
-
Size
7KB
-
Sample
240805-ezs6xawhpr
-
MD5
90c3dfd74d6ab4b7b98777930ab44a23
-
SHA1
7f536fa9c3972c4416e8620335e39f9e93092103
-
SHA256
6308f3eef2d45148c4544a0c31d5bb73f28dac4b6fcb854e003e2caa0c39d26f
-
SHA512
aab364913c7f3972a136d2cf9241e46adf275bf74cdaedd0697746b4d0244a517a832154ead9849c36d2cc710c80e2754cff1d2b5c845041f0b5e0d6fd115a92
-
SSDEEP
12:b4tdk5jtnrC0yyGyDF98oul666666666666HW4xmBWp/CR898U7LtaJO20c1H:b4/otrlyRKubxwWRCRKpJD8H
Static task
static1
Behavioral task
behavioral1
Sample
sasa.bat
Resource
win7-20240729-en
Malware Config
Extracted
http://20.199.84.103/Client.exe
Extracted
asyncrat
1.0.7
Default
127.0.0.1:1024
20.199.84.103:1024
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
sasa.bat
-
Size
7KB
-
MD5
90c3dfd74d6ab4b7b98777930ab44a23
-
SHA1
7f536fa9c3972c4416e8620335e39f9e93092103
-
SHA256
6308f3eef2d45148c4544a0c31d5bb73f28dac4b6fcb854e003e2caa0c39d26f
-
SHA512
aab364913c7f3972a136d2cf9241e46adf275bf74cdaedd0697746b4d0244a517a832154ead9849c36d2cc710c80e2754cff1d2b5c845041f0b5e0d6fd115a92
-
SSDEEP
12:b4tdk5jtnrC0yyGyDF98oul666666666666HW4xmBWp/CR898U7LtaJO20c1H:b4/otrlyRKubxwWRCRKpJD8H
-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-