General
-
Target
Client.exe
-
Size
47KB
-
Sample
240814-cm7sesvcre
-
MD5
539ca8c5f34be270f01fefe8a24d0b22
-
SHA1
05a4b9d92658de4b9c5ef4ca8eefa2dfe8a60be6
-
SHA256
f1d37a9a6cce462289e6677d69e9608820572350d732db4ddacf5f4bb53c1794
-
SHA512
fab6f3e8114d4680d94e6e99fbc3de919a27d7160f48adbde459e75c889c3b01d3234f1514868af4af1cf541b451be7e6a260abc9ad40bfbed711aef0c729db8
-
SSDEEP
768:wC0aWbILWCaS+DiRtelDSN+iV08YbygeJge1ymvEgK/JnZVc6KN:wpaMWRtKDs4zb1RewmnkJnZVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8848
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
Yes.exe
-
install_folder
%AppData%
Targets
-
-
Target
Client.exe
-
Size
47KB
-
MD5
539ca8c5f34be270f01fefe8a24d0b22
-
SHA1
05a4b9d92658de4b9c5ef4ca8eefa2dfe8a60be6
-
SHA256
f1d37a9a6cce462289e6677d69e9608820572350d732db4ddacf5f4bb53c1794
-
SHA512
fab6f3e8114d4680d94e6e99fbc3de919a27d7160f48adbde459e75c889c3b01d3234f1514868af4af1cf541b451be7e6a260abc9ad40bfbed711aef0c729db8
-
SSDEEP
768:wC0aWbILWCaS+DiRtelDSN+iV08YbygeJge1ymvEgK/JnZVc6KN:wpaMWRtKDs4zb1RewmnkJnZVclN
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-