General
-
Target
nigga.exe
-
Size
47KB
-
Sample
250329-yje4wswsez
-
MD5
3a89fa04e508172538fb62323065d621
-
SHA1
7a8e7fb80e4919630dc1780916d4f385975942bd
-
SHA256
9a4798fb51cd9ab16766be2172b208e2bed0fb59787058c25dfa2e26e4918f37
-
SHA512
554c60aebe07e992f496cfdbee506186089560d468b5e4bb00b16bc7191ee541081f6c9c6c7e79c43cc0c21fe668fbdf113edd0c93bdd8671f67cf2b4cd6a230
-
SSDEEP
768:QAUR8bIL+Cyq+DikcPoAil2YbbgefXzERTvEgK/JXZVc6KN:QPIeLPONbkvnkJXZVclN
Behavioral task
behavioral1
Sample
nigga.exe
Resource
win7-20240903-en
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8848
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
taskmgr.exe
-
install_folder
%AppData%
Targets
-
-
Target
nigga.exe
-
Size
47KB
-
MD5
3a89fa04e508172538fb62323065d621
-
SHA1
7a8e7fb80e4919630dc1780916d4f385975942bd
-
SHA256
9a4798fb51cd9ab16766be2172b208e2bed0fb59787058c25dfa2e26e4918f37
-
SHA512
554c60aebe07e992f496cfdbee506186089560d468b5e4bb00b16bc7191ee541081f6c9c6c7e79c43cc0c21fe668fbdf113edd0c93bdd8671f67cf2b4cd6a230
-
SSDEEP
768:QAUR8bIL+Cyq+DikcPoAil2YbbgefXzERTvEgK/JXZVc6KN:QPIeLPONbkvnkJXZVclN
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-