General
-
Target
Rat.exe
-
Size
45KB
-
Sample
241204-3hb33awrby
-
MD5
45ce089045a1c4294dc9ad3722d29465
-
SHA1
d63e1ab062687aeab1d3d6a6709cf62b8b477c4d
-
SHA256
a5a58916499663c7377b89b29964883fa3253c177f66d1ea2f337432bc44e49c
-
SHA512
95219fb29535db52c3205f5fa28eb3a54e97b7dec9ad7768eade89255ec68d494a82da849efc68d2484b06f2075c305dd494fc01c2e00eedc75717c10e051dcb
-
SSDEEP
768:Oug1NTjgkH7F7WUHF9pmo2q7OUnZOEIs6JPIazjb1gX3pbPGr25siWBDZex:Oug1NTcIb2dSt/6ma3bSXZTVN4dex
Behavioral task
behavioral1
Sample
Rat.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
Rat.exe
Resource
win10ltsc2021-20241023-en
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
81.79.156.77:6606
81.79.156.77:7707
81.79.156.77:8808
FW2Ok6cukTID
-
delay
3
-
install
true
-
install_file
Discord.exe
-
install_folder
%Temp%
Targets
-
-
Target
Rat.exe
-
Size
45KB
-
MD5
45ce089045a1c4294dc9ad3722d29465
-
SHA1
d63e1ab062687aeab1d3d6a6709cf62b8b477c4d
-
SHA256
a5a58916499663c7377b89b29964883fa3253c177f66d1ea2f337432bc44e49c
-
SHA512
95219fb29535db52c3205f5fa28eb3a54e97b7dec9ad7768eade89255ec68d494a82da849efc68d2484b06f2075c305dd494fc01c2e00eedc75717c10e051dcb
-
SSDEEP
768:Oug1NTjgkH7F7WUHF9pmo2q7OUnZOEIs6JPIazjb1gX3pbPGr25siWBDZex:Oug1NTcIb2dSt/6ma3bSXZTVN4dex
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-