General
-
Target
9ca7ff61cdaa9b05da46da07587a4183f4ed3bdacf781e04e229f695d7d73000N
-
Size
47KB
-
Sample
241021-s89rxazgqm
-
MD5
4e0b89c963682a4a458d5b600d8facd0
-
SHA1
72b2cfe0bc78d556247562431565f55d2ac41acb
-
SHA256
9ca7ff61cdaa9b05da46da07587a4183f4ed3bdacf781e04e229f695d7d73000
-
SHA512
2a484bac3c9ce89f9273626c0f1a46fd3a25538c1688a6387c22e1f6224a54cccbc657743155b4a71b0206d59a1c346b4b117d323383395f876d39e180da3f8d
-
SSDEEP
768:IRUQgNIL4+M0+LiXPtWiEN8YbOgPE+iCrMvEgK/JXZVc6KN:IR1gjsXPt6zbxM+1AnkJXZVclN
Behavioral task
behavioral1
Sample
9ca7ff61cdaa9b05da46da07587a4183f4ed3bdacf781e04e229f695d7d73000N.exe
Resource
win7-20241010-en
Malware Config
Extracted
asyncrat
1.0.7
Default
zlehsdl-54193.portmap.host:54193
Mutex_manL
-
delay
1
-
install
true
-
install_file
client.exe
-
install_folder
%AppData%
Targets
-
-
Target
9ca7ff61cdaa9b05da46da07587a4183f4ed3bdacf781e04e229f695d7d73000N
-
Size
47KB
-
MD5
4e0b89c963682a4a458d5b600d8facd0
-
SHA1
72b2cfe0bc78d556247562431565f55d2ac41acb
-
SHA256
9ca7ff61cdaa9b05da46da07587a4183f4ed3bdacf781e04e229f695d7d73000
-
SHA512
2a484bac3c9ce89f9273626c0f1a46fd3a25538c1688a6387c22e1f6224a54cccbc657743155b4a71b0206d59a1c346b4b117d323383395f876d39e180da3f8d
-
SSDEEP
768:IRUQgNIL4+M0+LiXPtWiEN8YbOgPE+iCrMvEgK/JXZVc6KN:IR1gjsXPt6zbxM+1AnkJXZVclN
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-