General
-
Target
AsyncClient.exe
-
Size
45KB
-
Sample
250302-s6xpkaxrs2
-
MD5
670af6cdd160ac768544d9a7ebe9975e
-
SHA1
b96f901ab0ca03dcbc348c4f25839153265357d9
-
SHA256
aaebd2f26a0aa13a312b08d6c1f6fd62f57e744727da88c0c44d8d23c778dddd
-
SHA512
c491b5bb1db904ddf2d34add8794eed7ba074d633f4c5439ffdf41dbd23cf5d8f182808de9734a25b417229d02b814bd9bc35ec9c29861ed0588e2d9cfdb1166
-
SSDEEP
768:UuETKT0k3qXWUrV6e1mo2qyIQKjPGaG6PIyzjbFgX3i/p0yXGH0YWBDZVj:UuETKT0cE2/1KTkDy3bCXS/p0yu8dVj
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20240903-en
Malware Config
Extracted
asyncrat
0.5.8
Default
197.48.74.234:6606
xYOOhhxRbEW7
-
delay
3
-
install
true
-
install_file
ratatoulie.exe
-
install_folder
%AppData%
Targets
-
-
Target
AsyncClient.exe
-
Size
45KB
-
MD5
670af6cdd160ac768544d9a7ebe9975e
-
SHA1
b96f901ab0ca03dcbc348c4f25839153265357d9
-
SHA256
aaebd2f26a0aa13a312b08d6c1f6fd62f57e744727da88c0c44d8d23c778dddd
-
SHA512
c491b5bb1db904ddf2d34add8794eed7ba074d633f4c5439ffdf41dbd23cf5d8f182808de9734a25b417229d02b814bd9bc35ec9c29861ed0588e2d9cfdb1166
-
SSDEEP
768:UuETKT0k3qXWUrV6e1mo2qyIQKjPGaG6PIyzjbFgX3i/p0yXGH0YWBDZVj:UuETKT0cE2/1KTkDy3bCXS/p0yu8dVj
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-