asyncrat | 0de532cb86613a400698f3a4062d294a5b9255468b3379167b35534329cb522a

Sharing

Copy URL Twitter E-mail

General

Target
0de532cb86613a400698f3a4062d294a5b9255468b3379167b35534329cb522a.exe
Size 45KB
Sample260701-kktf1sb15t
SHA256 0de532cb86613a400698f3a4062d294a5b9255468b3379167b35534329cb522a
MD5 d5f8b2402c0bfd5dc9feafc4bc76351f
SHA1 2072aaff16d14b4ed975d46135c6f5f6410e1c80
SHA512 545bd0b7949d53f4e6085eff3551f4e59efb34070314f241d26772e144ad22db4263a21c023ce1ac3d68f16bab6f83a403a9aec113bc6f13fc8370838b002fe6
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozfy3CKPI09jbWgX3ihXRpoM9GYBDZsx:EufspTf2g20TR0VbJXShbbdsx
TLSH
T1DB233B0037E8C12BF2BE5B78ADF26145867AF6632603D64D1CC411DB5723BC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

istanbulozelegitim.net:80
istanbulozelegitim.net:22
istanbulozelegitim.net:8080
istanbulozelegitim.net:8880
istanbulozelegitim.net:2052
istanbulozelegitim.net:2082
istanbulozelegitim.net:2086
istanbulozelegitim.net:2095
istanbulozelegitim.net:443
istanbulozelegitim.net:2053
istanbulozelegitim.net:2083
istanbulozelegitim.net:2087
istanbulozelegitim.net:2096
istanbulozelegitim.net:8443
www.istanbulozelegitim.net:80
www.istanbulozelegitim.net:22
www.istanbulozelegitim.net:8080
www.istanbulozelegitim.net:8880
www.istanbulozelegitim.net:2052
www.istanbulozelegitim.net:2082
www.istanbulozelegitim.net:2086
www.istanbulozelegitim.net:2095
www.istanbulozelegitim.net:443
www.istanbulozelegitim.net:2053
www.istanbulozelegitim.net:2083
www.istanbulozelegitim.net:2087
www.istanbulozelegitim.net:2096
www.istanbulozelegitim.net:8443
wannacry.istanbulozelegitim.net:80
wannacry.istanbulozelegitim.net:22
wannacry.istanbulozelegitim.net:8080
wannacry.istanbulozelegitim.net:8880
wannacry.istanbulozelegitim.net:2052
wannacry.istanbulozelegitim.net:2082
wannacry.istanbulozelegitim.net:2086
wannacry.istanbulozelegitim.net:2095
wannacry.istanbulozelegitim.net:443
wannacry.istanbulozelegitim.net:2053
wannacry.istanbulozelegitim.net:2083
wannacry.istanbulozelegitim.net:2087
wannacry.istanbulozelegitim.net:2096
wannacry.istanbulozelegitim.net:8443
rat.istanbulozelegitim.net:80
rat.istanbulozelegitim.net:22
rat.istanbulozelegitim.net:8080
rat.istanbulozelegitim.net:8880
rat.istanbulozelegitim.net:2052
rat.istanbulozelegitim.net:2082
rat.istanbulozelegitim.net:2086
rat.istanbulozelegitim.net:2095
rat.istanbulozelegitim.net:443
rat.istanbulozelegitim.net:2053
rat.istanbulozelegitim.net:2083
rat.istanbulozelegitim.net:2087
rat.istanbulozelegitim.net:2096
rat.istanbulozelegitim.net:8443

Mutex

30agjrTYssWj

Attributes

delay
0
install
true
install_file
5i6q3tb.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  0de532cb86613a400698f3a4062d294a5b9255468b3379167b35534329cb522a.exe
- Size 45KB
- SHA256 0de532cb86613a400698f3a4062d294a5b9255468b3379167b35534329cb522a
- MD5 d5f8b2402c0bfd5dc9feafc4bc76351f
- SHA1 2072aaff16d14b4ed975d46135c6f5f6410e1c80
- SHA512 545bd0b7949d53f4e6085eff3551f4e59efb34070314f241d26772e144ad22db4263a21c023ce1ac3d68f16bab6f83a403a9aec113bc6f13fc8370838b002fe6
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozfy3CKPI09jbWgX3ihXRpoM9GYBDZsx:EufspTf2g20TR0VbJXShbbdsx
- TLSH
  T1DB233B0037E8C12BF2BE5B78ADF26145867AF6632603D64D1CC411DB5723BC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2