General
-
Target
Discord.exe
-
Size
45KB
-
Sample
241213-mjtfqsxmbm
-
MD5
05b54deb0e3e6a3fb9155a14642b50ba
-
SHA1
77bf6744502a5946861baf104c1cf4babc171b9c
-
SHA256
c759cde09cf057c2430ceb74bd7f15427d2ad27f0b77dcc8630c8a148486cf27
-
SHA512
3668e77850acfb0c42f1d15de08fcd737f0c6d7087f25f6404b1f378aea94ca34ab0d85f2bea1c8a9d11692a039d0fa42aeec4876bb802ae2c192608e5bc5a9b
-
SSDEEP
768:6uKQ9TH4EjZWUR/ejmo2qrYKjPGaG6PIyzjbFgX3i6cpxs298YBDZTx:6uKQ9THfe2BKTkDy3bCXSpF9LdTx
Behavioral task
behavioral1
Sample
Discord.exe
Resource
win7-20240708-en
Malware Config
Extracted
asyncrat
0.5.8
Default
18.ip.gl.ply.gg:6606
18.ip.gl.ply.gg:7707
18.ip.gl.ply.gg:8808
18.ip.gl.ply.gg:9028
lmk8StbxTzvz
-
delay
3
-
install
true
-
install_file
Discord.exe
-
install_folder
%AppData%
Targets
-
-
Target
Discord.exe
-
Size
45KB
-
MD5
05b54deb0e3e6a3fb9155a14642b50ba
-
SHA1
77bf6744502a5946861baf104c1cf4babc171b9c
-
SHA256
c759cde09cf057c2430ceb74bd7f15427d2ad27f0b77dcc8630c8a148486cf27
-
SHA512
3668e77850acfb0c42f1d15de08fcd737f0c6d7087f25f6404b1f378aea94ca34ab0d85f2bea1c8a9d11692a039d0fa42aeec4876bb802ae2c192608e5bc5a9b
-
SSDEEP
768:6uKQ9TH4EjZWUR/ejmo2qrYKjPGaG6PIyzjbFgX3i6cpxs298YBDZTx:6uKQ9THfe2BKTkDy3bCXSpF9LdTx
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-