General
-
Target
bro.exe
-
Size
47KB
-
Sample
241218-dhgk4szmey
-
MD5
83fc5776b79aad95fecd322f11f80187
-
SHA1
412ccb9ab9e743907eef7be3b47568decefbd15f
-
SHA256
e87744178fba28b505eccbf4847a77f84877a8bd8f50ce17f5f6f68a0ea41327
-
SHA512
1552e626f349c66f7e555326e68d97aa87a4971b6c4b912514f1bfa39036d17c9295e88e0f49c349cac2758974e060535044ea4d09a25f2949f45ab79f0c838b
-
SSDEEP
768:MuY69T3kH1jWUvTqRmo2qbRc4wmDPItjd0axq0bE6zrvtOoqJ/UBDZ0x:MuY69T34y2AwmMtjZHbE6/vgMd0x
Behavioral task
behavioral1
Sample
bro.exe
Resource
win7-20240903-en
Malware Config
Extracted
asyncrat
0.5.8
Default
desktop-ukmnq5d-wasda.at.remote.it:33006
tTT9mCTiJnq9
-
delay
3
-
install
true
-
install_file
roar.exe
-
install_folder
%AppData%
Targets
-
-
Target
bro.exe
-
Size
47KB
-
MD5
83fc5776b79aad95fecd322f11f80187
-
SHA1
412ccb9ab9e743907eef7be3b47568decefbd15f
-
SHA256
e87744178fba28b505eccbf4847a77f84877a8bd8f50ce17f5f6f68a0ea41327
-
SHA512
1552e626f349c66f7e555326e68d97aa87a4971b6c4b912514f1bfa39036d17c9295e88e0f49c349cac2758974e060535044ea4d09a25f2949f45ab79f0c838b
-
SSDEEP
768:MuY69T3kH1jWUvTqRmo2qbRc4wmDPItjd0axq0bE6zrvtOoqJ/UBDZ0x:MuY69T34y2AwmMtjZHbE6/vgMd0x
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-