General
-
Target
3.exe
-
Size
63KB
-
Sample
241207-rlcyzsvkg1
-
MD5
33ea3434e9a9801f718c7b652166013c
-
SHA1
24f9421b607361865c05f1b5ce4e1e75ce89e064
-
SHA256
0a393957e15c85531debe65786b7758d1102f9f352223dd300703917f3161536
-
SHA512
3dd4fdb8e50d27f5a65d0ef2e28f393fadc41a3099ed0e9e293b8b2b8c0c34875abb8ad03a62d9ac975594505537ea24b64f509a252af6e9c4daf374c3a091d2
-
SSDEEP
1536:fJxFz3FI8Cwof4wJK7bkyyiNuGbb9wmsRIGBZVclN:fJxFz3FI8Cwo7JK7bky/AGbb96JzY
Malware Config
Extracted
asyncrat
1.0.7
Default
fojeweb571-59953.portmap.host:59953
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
windows defender firewall.exe
-
install_folder
%AppData%
Targets
-
-
Target
3.exe
-
Size
63KB
-
MD5
33ea3434e9a9801f718c7b652166013c
-
SHA1
24f9421b607361865c05f1b5ce4e1e75ce89e064
-
SHA256
0a393957e15c85531debe65786b7758d1102f9f352223dd300703917f3161536
-
SHA512
3dd4fdb8e50d27f5a65d0ef2e28f393fadc41a3099ed0e9e293b8b2b8c0c34875abb8ad03a62d9ac975594505537ea24b64f509a252af6e9c4daf374c3a091d2
-
SSDEEP
1536:fJxFz3FI8Cwof4wJK7bkyyiNuGbb9wmsRIGBZVclN:fJxFz3FI8Cwo7JK7bky/AGbb96JzY
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-