General
-
Target
3.exe
-
Size
48KB
-
Sample
241207-r4aatavqbw
-
MD5
3d9e11f133404b0de3f4fd7e375e3fbf
-
SHA1
1da48c172f95eb337a3b3427f6360d112abf907e
-
SHA256
929bd74e00c56ec0935d5390a89dd4942abc1f3511a267034739fff0491e350b
-
SHA512
77aa948b664f957851bb33d2276df7315d5f05abe912bed1214f6e37270a525799fb04cacd0e17a6c07fff55f96a32222ecf71fcf2104e71de153c64de8f147c
-
SSDEEP
768:eVVFxILHtFp+BirI7Vf2ki6Y8Yb4gepge+6BvEgK/JYZVc6KN:eV27Eorzbvt6BnkJYZVclN
Behavioral task
behavioral1
Sample
3.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8848
127.0.0.1:52039
dfsgmnhsrf23456623423456-52039.portmap.host:8848
dfsgmnhsrf23456623423456-52039.portmap.host:52039
DcRatMutex_qwqdanchunxinsfd,mhbm gdfvg
-
delay
1
-
install
true
-
install_file
windows defender firewall required.exe
-
install_folder
%AppData%
Targets
-
-
Target
3.exe
-
Size
48KB
-
MD5
3d9e11f133404b0de3f4fd7e375e3fbf
-
SHA1
1da48c172f95eb337a3b3427f6360d112abf907e
-
SHA256
929bd74e00c56ec0935d5390a89dd4942abc1f3511a267034739fff0491e350b
-
SHA512
77aa948b664f957851bb33d2276df7315d5f05abe912bed1214f6e37270a525799fb04cacd0e17a6c07fff55f96a32222ecf71fcf2104e71de153c64de8f147c
-
SSDEEP
768:eVVFxILHtFp+BirI7Vf2ki6Y8Yb4gepge+6BvEgK/JYZVc6KN:eV27Eorzbvt6BnkJYZVclN
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-