General
-
Target
AsyncClient.exe
-
Size
47KB
-
Sample
250119-w1avdszlex
-
MD5
f6093b7c45edb15a9d1bf77c5ea7fc6f
-
SHA1
eec1c1c523fe47fcba093c109c67320c38dc0db2
-
SHA256
49faef491cbfe43dd44266f822d744a9d5543fd01375c2b3d89fbe744ff7b400
-
SHA512
ba0a3f173c4e4927a581a2d2aa8a17340f0f0548c4311afe8d84183769978e81a3df1ce4525cd349455f7d6c197755871ddfa5eedd8111738e6dd76850608e73
-
SSDEEP
768:Nuu91TwQsOnFWUFN1/mo2qDaIvyP10ozjFz2PI87fl/nt0bCyJpBuaOk0KB07JDG:Nuu91TwSb231pZ/8LlCbCqcDgBYdQkdK
Malware Config
Extracted
asyncrat
0.5.8
Default
trip-thesaurus.gl.at.ply.gg:6606
trip-thesaurus.gl.at.ply.gg:8808
trip-thesaurus.gl.at.ply.gg:1337
sk4bkiT4mXvt
-
delay
3
-
install
true
-
install_file
edada.exe
-
install_folder
%AppData%
Targets
-
-
Target
AsyncClient.exe
-
Size
47KB
-
MD5
f6093b7c45edb15a9d1bf77c5ea7fc6f
-
SHA1
eec1c1c523fe47fcba093c109c67320c38dc0db2
-
SHA256
49faef491cbfe43dd44266f822d744a9d5543fd01375c2b3d89fbe744ff7b400
-
SHA512
ba0a3f173c4e4927a581a2d2aa8a17340f0f0548c4311afe8d84183769978e81a3df1ce4525cd349455f7d6c197755871ddfa5eedd8111738e6dd76850608e73
-
SSDEEP
768:Nuu91TwQsOnFWUFN1/mo2qDaIvyP10ozjFz2PI87fl/nt0bCyJpBuaOk0KB07JDG:Nuu91TwSb231pZ/8LlCbCqcDgBYdQkdK
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-