General
-
Target
d224b20b8c858da3bac1c5fb9cd1c33b.exe
-
Size
310KB
-
Sample
240126-rk5mlsfed4
-
MD5
d224b20b8c858da3bac1c5fb9cd1c33b
-
SHA1
e1d256a961662b1b45c23a2bfc4e4edf2d30b177
-
SHA256
201d93bf0cba57d6bf22201311f082c11dde20bf1269d5275539df14fd502398
-
SHA512
e281343bc2e0d197c21bc442aefb27526515807e3279f8fd9636aea19b6fbc1dd5a5be3038615c513d60568e0ea821ea6c080efce43d059e30032a93cc1190ba
-
SSDEEP
6144:BbiQqdJ052x8C2adFIYI906jqGFPkoh7Y0gJamWKw7eMT129ZW5sNdaYmOdhzStP:BbiQz52aC1sP906mG53h7c/RQ1p5C4LP
Static task
static1
Behavioral task
behavioral1
Sample
d224b20b8c858da3bac1c5fb9cd1c33b.exe
Resource
win7-20231129-en
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:4217
146.70.161.85:4217
dkhXL7HeeLRM
-
delay
3
-
install
true
-
install_file
Colours.exe
-
install_folder
%AppData%
Targets
-
-
Target
d224b20b8c858da3bac1c5fb9cd1c33b.exe
-
Size
310KB
-
MD5
d224b20b8c858da3bac1c5fb9cd1c33b
-
SHA1
e1d256a961662b1b45c23a2bfc4e4edf2d30b177
-
SHA256
201d93bf0cba57d6bf22201311f082c11dde20bf1269d5275539df14fd502398
-
SHA512
e281343bc2e0d197c21bc442aefb27526515807e3279f8fd9636aea19b6fbc1dd5a5be3038615c513d60568e0ea821ea6c080efce43d059e30032a93cc1190ba
-
SSDEEP
6144:BbiQqdJ052x8C2adFIYI906jqGFPkoh7Y0gJamWKw7eMT129ZW5sNdaYmOdhzStP:BbiQz52aC1sP906mG53h7c/RQ1p5C4LP
-
Detect ZGRat V1
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-