General
-
Target
d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe
-
Size
63KB
-
Sample
241125-pzjbtatmdq
-
MD5
103629304104bf87dc75a086f3aebdb2
-
SHA1
6a03d4e5bba8c4ffb6c7432f948951b9c6064130
-
SHA256
d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc
-
SHA512
30647aa2adf2d7991385b730e15e9954b4b6ba58ab551850ab450b7f83c91b8c89f21de3bbf43fd4e9f858f65a1eac471b929821263c86966d16ead526206604
-
SSDEEP
768:otD5i7QHEU78j8C8A+XiV07hobtVZTnR48uyq1+T43SBGHmDbDBph0of3g4tyySI:GIgE8lwtNliQYUbrhB3g4AugdpqKmY7E
Behavioral task
behavioral1
Sample
d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe
Resource
win7-20240708-en
Malware Config
Extracted
asyncrat
Default
127.0.0.1:4321
127.0.0.1:17567
company-parker.gl.at.ply.gg:4321
company-parker.gl.at.ply.gg:17567
-
delay
1
-
install
true
-
install_file
Grettaexecutor.exe
-
install_folder
%AppData%
Targets
-
-
Target
d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc.exe
-
Size
63KB
-
MD5
103629304104bf87dc75a086f3aebdb2
-
SHA1
6a03d4e5bba8c4ffb6c7432f948951b9c6064130
-
SHA256
d34baac584dbdb97e38274818de69e3aaea8877962c4f50b0b67d51d36e5afcc
-
SHA512
30647aa2adf2d7991385b730e15e9954b4b6ba58ab551850ab450b7f83c91b8c89f21de3bbf43fd4e9f858f65a1eac471b929821263c86966d16ead526206604
-
SSDEEP
768:otD5i7QHEU78j8C8A+XiV07hobtVZTnR48uyq1+T43SBGHmDbDBph0of3g4tyySI:GIgE8lwtNliQYUbrhB3g4AugdpqKmY7E
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-