General
-
Target
file.exe
-
Size
149KB
-
Sample
241202-1zqaxa1mej
-
MD5
92a881475c40674255bea18c1e5fbcef
-
SHA1
bf62aaab46c70a56152d63ff48596938cb24356e
-
SHA256
4a75b767a2a204c678bd2790e45c7aca74f80c84530705127340fb7b82e87ca2
-
SHA512
85270af1aa7fb0ad77aef0b21cf5ab858acac41a3f61595437b45886e003ac82b3c73cccba40363ef145b8b0cc27dcaef6afa283c5f579085cdba86107c4302c
-
SSDEEP
3072:lrEHFS+7rEkM5InknaPa9+FQ2WP3zSQ5Sj6HQOSbLkHVh4dI3T:eHR5nPYM8+QXdS3k16i3T
Static task
static1
Malware Config
Extracted
asyncrat
1.0.7
Default
man-soft.gl.at.ply.gg:15630
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
cmd.exe
-
install_folder
%AppData%
Targets
-
-
Target
file.exe
-
Size
149KB
-
MD5
92a881475c40674255bea18c1e5fbcef
-
SHA1
bf62aaab46c70a56152d63ff48596938cb24356e
-
SHA256
4a75b767a2a204c678bd2790e45c7aca74f80c84530705127340fb7b82e87ca2
-
SHA512
85270af1aa7fb0ad77aef0b21cf5ab858acac41a3f61595437b45886e003ac82b3c73cccba40363ef145b8b0cc27dcaef6afa283c5f579085cdba86107c4302c
-
SSDEEP
3072:lrEHFS+7rEkM5InknaPa9+FQ2WP3zSQ5Sj6HQOSbLkHVh4dI3T:eHR5nPYM8+QXdS3k16i3T
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-