asyncrat | ee72f33a1b1bf81ff2b0ac8d341fb30309e37433adc20900d85d9e22956c1f5f

Sharing

Copy URL Twitter E-mail

General

Target
ee72f33a1b1bf81ff2b0ac8d341fb30309e37433adc20900d85d9e22956c1f5f
Size 45KB
Sample260701-l1dk6sa18m
SHA256 ee72f33a1b1bf81ff2b0ac8d341fb30309e37433adc20900d85d9e22956c1f5f
MD5 01df9d9b73adafdc47af34f07e4c9834
SHA1 022a2dc1dcaad20d0f302da1082bd0d57497db17
SHA512 420d53e1e755c7f570e46e011248b126bdf1114e98062d58b0743a74a2adb63b783c040609ec98fcc928af542db2cb161ecd91ffd1438875a3f081d702fec1c0
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIk1ujbbgX3ij6TMOn5T8oR6s+I:MuBGJTPho2Q/CFWBk1CbkXSj6TwoxmjE
TLSH
T1B9231A003BE9C12BF6BE4F7899F26141867AF6632903D64A1C8451DB5713FC68A43AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xxxtop.net:80
xxxtop.net:22
xxxtop.net:8080
xxxtop.net:8880
xxxtop.net:2052
xxxtop.net:2082
xxxtop.net:2086
xxxtop.net:2095
xxxtop.net:443
xxxtop.net:2053
xxxtop.net:2083
xxxtop.net:2087
xxxtop.net:2096
xxxtop.net:8443
www.xxxtop.net:80
www.xxxtop.net:22
www.xxxtop.net:8080
www.xxxtop.net:8880
www.xxxtop.net:2052
www.xxxtop.net:2082
www.xxxtop.net:2086
www.xxxtop.net:2095
www.xxxtop.net:443
www.xxxtop.net:2053
www.xxxtop.net:2083
www.xxxtop.net:2087
www.xxxtop.net:2096
www.xxxtop.net:8443
socgholish.xxxtop.net:80
socgholish.xxxtop.net:22
socgholish.xxxtop.net:8080
socgholish.xxxtop.net:8880
socgholish.xxxtop.net:2052
socgholish.xxxtop.net:2082
socgholish.xxxtop.net:2086
socgholish.xxxtop.net:2095
socgholish.xxxtop.net:443
socgholish.xxxtop.net:2053
socgholish.xxxtop.net:2083
socgholish.xxxtop.net:2087
socgholish.xxxtop.net:2096
socgholish.xxxtop.net:8443
invasive.xxxtop.net:80
invasive.xxxtop.net:22
invasive.xxxtop.net:8080
invasive.xxxtop.net:8880
invasive.xxxtop.net:2052
invasive.xxxtop.net:2082
invasive.xxxtop.net:2086
invasive.xxxtop.net:2095
invasive.xxxtop.net:443
invasive.xxxtop.net:2053
invasive.xxxtop.net:2083
invasive.xxxtop.net:2087
invasive.xxxtop.net:2096
invasive.xxxtop.net:8443
rat.xxxtop.net:80
rat.xxxtop.net:22
rat.xxxtop.net:8080
rat.xxxtop.net:8880
rat.xxxtop.net:2052
rat.xxxtop.net:2082
rat.xxxtop.net:2086
rat.xxxtop.net:2095
rat.xxxtop.net:443
rat.xxxtop.net:2053
rat.xxxtop.net:2083
rat.xxxtop.net:2087
rat.xxxtop.net:2096
rat.xxxtop.net:8443
agenttesla.xxxtop.net:80
agenttesla.xxxtop.net:22
agenttesla.xxxtop.net:8080
agenttesla.xxxtop.net:8880
agenttesla.xxxtop.net:2052
agenttesla.xxxtop.net:2082
agenttesla.xxxtop.net:2086
agenttesla.xxxtop.net:2095
agenttesla.xxxtop.net:443
agenttesla.xxxtop.net:2053
agenttesla.xxxtop.net:2083
agenttesla.xxxtop.net:2087
agenttesla.xxxtop.net:2096
agenttesla.xxxtop.net:8443

Mutex

tnoiJeW54fji

Attributes

delay
0
install
true
install_file
dffc.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  ee72f33a1b1bf81ff2b0ac8d341fb30309e37433adc20900d85d9e22956c1f5f
- Size 45KB
- SHA256 ee72f33a1b1bf81ff2b0ac8d341fb30309e37433adc20900d85d9e22956c1f5f
- MD5 01df9d9b73adafdc47af34f07e4c9834
- SHA1 022a2dc1dcaad20d0f302da1082bd0d57497db17
- SHA512 420d53e1e755c7f570e46e011248b126bdf1114e98062d58b0743a74a2adb63b783c040609ec98fcc928af542db2cb161ecd91ffd1438875a3f081d702fec1c0
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIk1ujbbgX3ij6TMOn5T8oR6s+I:MuBGJTPho2Q/CFWBk1CbkXSj6TwoxmjE
- TLSH
  T1B9231A003BE9C12BF6BE4F7899F26141867AF6632903D64A1C8451DB5713FC68A43AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2