General
-
Target
AsyncClient.exe
-
Size
47KB
-
Sample
240816-rqd2vayhpe
-
MD5
2fdc954cd7e67e334bfe190bbb64d0ba
-
SHA1
315f1f6606857285750f5017f5dc8bb18cb9ce64
-
SHA256
49ed02a2f8ace5109a2f4338337adcf13b5ede8cf604e8503b6104b1b15abac8
-
SHA512
74dbdfec21a062afbed84ecdfeb1a8f4ce7263fa8dcf19cfad69eaa3614d25756d3c99ab1d2470ea0f8c13bb04c5519a4738f0fd021a5d3ab63d1ec72f10405f
-
SSDEEP
768:Auk0VT3ongoWU2Gjimo2qr574wBW1APIz9G464EP0bSVKbAg+oa1BmM7ikjMbvvO:Auk0VT3Q+2GDBW1l5G4647bShb1BekAC
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:7707
127.0.0.1:8808
fXvhcv23OBXx
-
delay
3
-
install
true
-
install_file
hey.exe
-
install_folder
%AppData%
Targets
-
-
Target
AsyncClient.exe
-
Size
47KB
-
MD5
2fdc954cd7e67e334bfe190bbb64d0ba
-
SHA1
315f1f6606857285750f5017f5dc8bb18cb9ce64
-
SHA256
49ed02a2f8ace5109a2f4338337adcf13b5ede8cf604e8503b6104b1b15abac8
-
SHA512
74dbdfec21a062afbed84ecdfeb1a8f4ce7263fa8dcf19cfad69eaa3614d25756d3c99ab1d2470ea0f8c13bb04c5519a4738f0fd021a5d3ab63d1ec72f10405f
-
SSDEEP
768:Auk0VT3ongoWU2Gjimo2qr574wBW1APIz9G464EP0bSVKbAg+oa1BmM7ikjMbvvO:Auk0VT3Q+2GDBW1l5G4647bShb1BekAC
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-