General
-
Target
Client.exe
-
Size
63KB
-
Sample
241207-bwmm6sykgz
-
MD5
cb6a1f003f6937e3275c90bf3d8e7408
-
SHA1
922efe4440e8d9966e7f47294b3ff9882c325a55
-
SHA256
430407cd2dc4ffbdf3423a871caaf431984ee6dc2475bcff64c506919a1e28a0
-
SHA512
3c57b39be6378036d4a5de80aa35139c34965b76ce35b4d22e25f59202d0f5b2665ad9f35e77b47b423060cd00e0c78c20456a99054d705f008fef3cec9c92ea
-
SSDEEP
1536:ihgjnR1Aio/cxbDc4m7nVeeiMl8GbbXwRnb+GpZVclN:ihgjnR1Aio/cxbDcnnoeFmGbbXQnbrzY
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8848
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
MinecraftUpdater.exe
-
install_folder
%AppData%
Targets
-
-
Target
Client.exe
-
Size
63KB
-
MD5
cb6a1f003f6937e3275c90bf3d8e7408
-
SHA1
922efe4440e8d9966e7f47294b3ff9882c325a55
-
SHA256
430407cd2dc4ffbdf3423a871caaf431984ee6dc2475bcff64c506919a1e28a0
-
SHA512
3c57b39be6378036d4a5de80aa35139c34965b76ce35b4d22e25f59202d0f5b2665ad9f35e77b47b423060cd00e0c78c20456a99054d705f008fef3cec9c92ea
-
SSDEEP
1536:ihgjnR1Aio/cxbDc4m7nVeeiMl8GbbXwRnb+GpZVclN:ihgjnR1Aio/cxbDcnnoeFmGbbXQnbrzY
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-