General
-
Target
Client.exe
-
Size
48KB
-
Sample
241207-sz92bawngv
-
MD5
77ca225fb7c84aad1e8ee9ead0110b4c
-
SHA1
b26e40f8e945f4db6621d7ca5a575a84c0565f91
-
SHA256
716b12fa63c467b57e24182ae3af25b738fc589f3f4f0aa5c516190f3eefbf00
-
SHA512
e8f2138cd82714ba58a30d9b48c7e61a6c42b17db297c332e078db544575404382ccf16dbd5bd0aced9342186b05b65a1da0426062b10729a40123a5887e3bbb
-
SSDEEP
768:ywpRILv+sx+LiEtelDSN+iV08YbygeYslsoo7RSYFr0bvEgK/JfZVc6KN:ywcpEtKDs4zb10rqjF4nkJfZVclN
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20241010-en
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8848
127.0.0.1:59953
fojeweb571-59953.portmap.host:8848
fojeweb571-59953.portmap.host:59953
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
windows defender firewall required.exe
-
install_folder
%AppData%
Targets
-
-
Target
Client.exe
-
Size
48KB
-
MD5
77ca225fb7c84aad1e8ee9ead0110b4c
-
SHA1
b26e40f8e945f4db6621d7ca5a575a84c0565f91
-
SHA256
716b12fa63c467b57e24182ae3af25b738fc589f3f4f0aa5c516190f3eefbf00
-
SHA512
e8f2138cd82714ba58a30d9b48c7e61a6c42b17db297c332e078db544575404382ccf16dbd5bd0aced9342186b05b65a1da0426062b10729a40123a5887e3bbb
-
SSDEEP
768:ywpRILv+sx+LiEtelDSN+iV08YbygeYslsoo7RSYFr0bvEgK/JfZVc6KN:ywcpEtKDs4zb10rqjF4nkJfZVclN
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-