General
-
Target
bootstrap.exe
-
Size
45KB
-
Sample
240821-zrswdszfkd
-
MD5
25ab471d602be90115bdd6841ecbc7ab
-
SHA1
ac8cabe33a562d931d8829a363cc0b719885177a
-
SHA256
2ba22889419f774476c31aa575e720606e9aa1c826992932a66cefacfb909af2
-
SHA512
ddd9603f8c7a53b2056b9cbd4630a9e63db8768d7480d701ab0eb5f98289e7116b4cdfc05c073610f2d7bea1e9a79f10e11aa083437f1ad6bdbe048efbf04d11
-
SSDEEP
768:BuQSNTvEEaBrWUXFd5mo2qmi8KjPGaG6PIyzjbFgX3iV6lNwYoCXBDZ3x:BuQSNT8572xvKTkDy3bCXSElNwqd3x
Behavioral task
behavioral1
Sample
bootstrap.exe
Resource
win7-20240705-en
Malware Config
Extracted
asyncrat
0.5.8
Default
baltekbezmajtek.zapto.org:6606
baltekbezmajtek.zapto.org:7707
baltekbezmajtek.zapto.org:8808
vBItBvMTrx8n
-
delay
3
-
install
true
-
install_file
cached_files.exe
-
install_folder
%AppData%
Extracted
latentbot
baltekbezmajtek.zapto.org
Targets
-
-
Target
bootstrap.exe
-
Size
45KB
-
MD5
25ab471d602be90115bdd6841ecbc7ab
-
SHA1
ac8cabe33a562d931d8829a363cc0b719885177a
-
SHA256
2ba22889419f774476c31aa575e720606e9aa1c826992932a66cefacfb909af2
-
SHA512
ddd9603f8c7a53b2056b9cbd4630a9e63db8768d7480d701ab0eb5f98289e7116b4cdfc05c073610f2d7bea1e9a79f10e11aa083437f1ad6bdbe048efbf04d11
-
SSDEEP
768:BuQSNTvEEaBrWUXFd5mo2qmi8KjPGaG6PIyzjbFgX3iV6lNwYoCXBDZ3x:BuQSNT8572xvKTkDy3bCXSElNwqd3x
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-