asyncrat | 9b8e3d77cf38f7de62692e618cab5c392d50c42cfa7de0b3206cbaa156acde86

Sharing

Copy URL Twitter E-mail

General

Target
9b8e3d77cf38f7de62692e618cab5c392d50c42cfa7de0b3206cbaa156acde86
Size 45KB
Sample260622-yqw1zsf14m
SHA256 9b8e3d77cf38f7de62692e618cab5c392d50c42cfa7de0b3206cbaa156acde86
MD5 b28dd47a4e6dd4f0194a431ffa9f39e3
SHA1 6c67bbc86b0b54f05a68c0ade377533a90088bb4
SHA512 c3ae6a34aa9dbdb853b33c683281ff13931ae2a27457df40f789774b3a2645767e05b395e62b0bcff937e1dde775b842fc6807f6508fb7f8d18f9ca7c613be7d
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwi3xq6YFoOPIUzjb7gu3i+umeyAMBAg4d6BDZMx:ku40ZTXEb2Wkxo3U3bEuSTmUQAgvdMx
TLSH
T1E7232B003BE8812BF1BE4F7899F26145867EE6736603D58A1CC451DB4B13FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cliphotgirl.com:80
cliphotgirl.com:22
cliphotgirl.com:8080
cliphotgirl.com:8880
cliphotgirl.com:2052
cliphotgirl.com:2082
cliphotgirl.com:2086
cliphotgirl.com:2095
cliphotgirl.com:443
cliphotgirl.com:2053
cliphotgirl.com:2083
cliphotgirl.com:2087
cliphotgirl.com:2096
cliphotgirl.com:8443
www.cliphotgirl.com:80
www.cliphotgirl.com:22
www.cliphotgirl.com:8080
www.cliphotgirl.com:8880
www.cliphotgirl.com:2052
www.cliphotgirl.com:2082
www.cliphotgirl.com:2086
www.cliphotgirl.com:2095
www.cliphotgirl.com:443
www.cliphotgirl.com:2053
www.cliphotgirl.com:2083
www.cliphotgirl.com:2087
www.cliphotgirl.com:2096
www.cliphotgirl.com:8443
zeus.cliphotgirl.com:80
zeus.cliphotgirl.com:22
zeus.cliphotgirl.com:8080
zeus.cliphotgirl.com:8880
zeus.cliphotgirl.com:2052
zeus.cliphotgirl.com:2082
zeus.cliphotgirl.com:2086
zeus.cliphotgirl.com:2095
zeus.cliphotgirl.com:443
zeus.cliphotgirl.com:2053
zeus.cliphotgirl.com:2083
zeus.cliphotgirl.com:2087
zeus.cliphotgirl.com:2096
zeus.cliphotgirl.com:8443
client.cliphotgirl.com:80
client.cliphotgirl.com:22
client.cliphotgirl.com:8080
client.cliphotgirl.com:8880
client.cliphotgirl.com:2052
client.cliphotgirl.com:2082
client.cliphotgirl.com:2086
client.cliphotgirl.com:2095
client.cliphotgirl.com:443
client.cliphotgirl.com:2053
client.cliphotgirl.com:2083
client.cliphotgirl.com:2087
client.cliphotgirl.com:2096
client.cliphotgirl.com:8443
remcos.cliphotgirl.com:80
remcos.cliphotgirl.com:22
remcos.cliphotgirl.com:8080
remcos.cliphotgirl.com:8880
remcos.cliphotgirl.com:2052
remcos.cliphotgirl.com:2082
remcos.cliphotgirl.com:2086
remcos.cliphotgirl.com:2095
remcos.cliphotgirl.com:443
remcos.cliphotgirl.com:2053
remcos.cliphotgirl.com:2083
remcos.cliphotgirl.com:2087
remcos.cliphotgirl.com:2096
remcos.cliphotgirl.com:8443
hacker.cliphotgirl.com:80
hacker.cliphotgirl.com:22
hacker.cliphotgirl.com:8080
hacker.cliphotgirl.com:8880
hacker.cliphotgirl.com:2052
hacker.cliphotgirl.com:2082
hacker.cliphotgirl.com:2086
hacker.cliphotgirl.com:2095
hacker.cliphotgirl.com:443
hacker.cliphotgirl.com:2053
hacker.cliphotgirl.com:2083
hacker.cliphotgirl.com:2087
hacker.cliphotgirl.com:2096
hacker.cliphotgirl.com:8443

Mutex

Krq2OkMX7rPp

Attributes

delay
0
install
true
install_file
stpdl.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  9b8e3d77cf38f7de62692e618cab5c392d50c42cfa7de0b3206cbaa156acde86
- Size 45KB
- SHA256 9b8e3d77cf38f7de62692e618cab5c392d50c42cfa7de0b3206cbaa156acde86
- MD5 b28dd47a4e6dd4f0194a431ffa9f39e3
- SHA1 6c67bbc86b0b54f05a68c0ade377533a90088bb4
- SHA512 c3ae6a34aa9dbdb853b33c683281ff13931ae2a27457df40f789774b3a2645767e05b395e62b0bcff937e1dde775b842fc6807f6508fb7f8d18f9ca7c613be7d
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwi3xq6YFoOPIUzjb7gu3i+umeyAMBAg4d6BDZMx:ku40ZTXEb2Wkxo3U3bEuSTmUQAgvdMx
- TLSH
  T1E7232B003BE8812BF1BE4F7899F26145867EE6736603D58A1CC451DB4B13FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2