General
-
Target
CVROV_Client.exe
-
Size
74KB
-
Sample
250411-jrbdcatmw8
-
MD5
5e793c335088bb693567b99127bc09b8
-
SHA1
b441f74292163a62f8de32f684ebf2d17741ca1b
-
SHA256
231a17f1d1c801f6fdca6fcc20d719abb4579dbc975cfa6bf58c0eb549193475
-
SHA512
3ee249faf035ada4730f00fc8d201007dbea8c6edf18030d21f89322d6761ad24912cf19e68b556ab45491ae8e3f8cadffc003961c42672af17383973406c3a7
-
SSDEEP
1536:QUpDcxvuoClufPMVKe9VdQuDI6H1bf/FwQzclLVclN:QUJcxvV3fPMVKe9VdQsH1bfNwQkBY
Malware Config
Extracted
asyncrat
L838 RAT v1.0.0
Default
127.0.0.1:54984
coinbasecrashout.ddns.net:54984
sfsafqagbiv
-
delay
1
-
install
true
-
install_file
Runtime Broker.exe
-
install_folder
%AppData%
Targets
-
-
Target
CVROV_Client.exe
-
Size
74KB
-
MD5
5e793c335088bb693567b99127bc09b8
-
SHA1
b441f74292163a62f8de32f684ebf2d17741ca1b
-
SHA256
231a17f1d1c801f6fdca6fcc20d719abb4579dbc975cfa6bf58c0eb549193475
-
SHA512
3ee249faf035ada4730f00fc8d201007dbea8c6edf18030d21f89322d6761ad24912cf19e68b556ab45491ae8e3f8cadffc003961c42672af17383973406c3a7
-
SSDEEP
1536:QUpDcxvuoClufPMVKe9VdQuDI6H1bf/FwQzclLVclN:QUJcxvV3fPMVKe9VdQsH1bfNwQkBY
-
Asyncrat family
-
Venomrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-