General
-
Target
e17921bea1470cc872b6a1a1ec2b31f82332bfefb57faaf1b782c5bda0d0530d
-
Size
63KB
-
Sample
250420-x7yepswkx9
-
MD5
b084f9671ccc68bff77cd3f15b784498
-
SHA1
c3ad6ea4d98109d3755b6eb8df7fd9410057662a
-
SHA256
e17921bea1470cc872b6a1a1ec2b31f82332bfefb57faaf1b782c5bda0d0530d
-
SHA512
bd4c8ed42dc954381c899a6ad645e44744a4a9571fda0ef59f41e0b1aa78278f1f4d4a1cdf3e46524cc54241d1a150b9e59567be78fc7da2240c854c84c2b33f
-
SSDEEP
768:kk/9PXn1w787gC8A+XvqazcBRL5JTk1+T4KSBGHmDbD/ph0oXryg6WcOSu13pqKX:xR1gMdSJYUbdh91cZu13pqKmY7
Behavioral task
behavioral1
Sample
e17921bea1470cc872b6a1a1ec2b31f82332bfefb57faaf1b782c5bda0d0530d.exe
Resource
win10v2004-20250313-en
Malware Config
Extracted
asyncrat
Default
carolina-candles.gl.at.ply.gg:34316
-
delay
1
-
install
true
-
install_file
square.exe
-
install_folder
%AppData%
Targets
-
-
Target
e17921bea1470cc872b6a1a1ec2b31f82332bfefb57faaf1b782c5bda0d0530d
-
Size
63KB
-
MD5
b084f9671ccc68bff77cd3f15b784498
-
SHA1
c3ad6ea4d98109d3755b6eb8df7fd9410057662a
-
SHA256
e17921bea1470cc872b6a1a1ec2b31f82332bfefb57faaf1b782c5bda0d0530d
-
SHA512
bd4c8ed42dc954381c899a6ad645e44744a4a9571fda0ef59f41e0b1aa78278f1f4d4a1cdf3e46524cc54241d1a150b9e59567be78fc7da2240c854c84c2b33f
-
SSDEEP
768:kk/9PXn1w787gC8A+XvqazcBRL5JTk1+T4KSBGHmDbD/ph0oXryg6WcOSu13pqKX:xR1gMdSJYUbdh91cZu13pqKmY7
-
Asyncrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-