General
-
Target
gggg.exe
-
Size
52KB
-
Sample
241221-trjptssqdl
-
MD5
fb6d592ff07d0e26a291b3e78c1ce139
-
SHA1
e5e82e613372b0795f8347ac643e954f0c514df2
-
SHA256
347586f7facf4ef5fcb456f6589d65cb3167a7fa4379740ff03b2c861d8cf364
-
SHA512
5db5797fcb1a6c2cbd2e2f4aaf2a5fd47f693116583596292531b73a36eabc8517ee7bc1d8cb5a999f45a5ca91152f0b3a810ec00ce35c8283f02d1c5e287779
-
SSDEEP
1536:2uu91TwSb2nth5csqQXb6HoTUdHN0QdH/:2uuDTwSb2tQsqwb6I4dtl9/
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:8808
10.59.25.45:8808
KxaqMLMZrN62
-
delay
3
-
install
true
-
install_file
Maple.exe
-
install_folder
%AppData%
Targets
-
-
Target
gggg.exe
-
Size
52KB
-
MD5
fb6d592ff07d0e26a291b3e78c1ce139
-
SHA1
e5e82e613372b0795f8347ac643e954f0c514df2
-
SHA256
347586f7facf4ef5fcb456f6589d65cb3167a7fa4379740ff03b2c861d8cf364
-
SHA512
5db5797fcb1a6c2cbd2e2f4aaf2a5fd47f693116583596292531b73a36eabc8517ee7bc1d8cb5a999f45a5ca91152f0b3a810ec00ce35c8283f02d1c5e287779
-
SSDEEP
1536:2uu91TwSb2nth5csqQXb6HoTUdHN0QdH/:2uuDTwSb2tQsqwb6I4dtl9/
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-