General
-
Target
iio.exe
-
Size
47KB
-
Sample
241224-g51t2ssngn
-
MD5
737848c12a722379d585dc4c05c0c382
-
SHA1
235ecf4b2a37303201eb08e4e5c8f4a5831b5e58
-
SHA256
9650473b3a6d1d9478797e85cd7ad79c071425d2a71014a874caedef435d1980
-
SHA512
680c28e49985f13593d402f6b7fcce56928dac2a5644342042f293c3603abe82905d53267b9b46a6f7a009fcbd2cf1d3e68abb498fa4f75c39ec0b8b90fd47fd
-
SSDEEP
768:KanemsORjPrinbfh7uKqaoRpPLmmN3TeWkuvCbH0bme4RJE5L4cDZ9f+:KanemsOR7xaApxhkuvaUbme4zArd9f+
Malware Config
Extracted
asyncrat
0.5.7B
SYR
147.185.221.24:6606
147.185.221.24:7707
147.185.221.24:8808
147.185.221.24:33931
Tg31N8yl8KBD
-
delay
3
-
install
true
-
install_file
Win32.exe
-
install_folder
%AppData%
Targets
-
-
Target
iio.exe
-
Size
47KB
-
MD5
737848c12a722379d585dc4c05c0c382
-
SHA1
235ecf4b2a37303201eb08e4e5c8f4a5831b5e58
-
SHA256
9650473b3a6d1d9478797e85cd7ad79c071425d2a71014a874caedef435d1980
-
SHA512
680c28e49985f13593d402f6b7fcce56928dac2a5644342042f293c3603abe82905d53267b9b46a6f7a009fcbd2cf1d3e68abb498fa4f75c39ec0b8b90fd47fd
-
SSDEEP
768:KanemsORjPrinbfh7uKqaoRpPLmmN3TeWkuvCbH0bme4RJE5L4cDZ9f+:KanemsOR7xaApxhkuvaUbme4zArd9f+
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-