asyncrat | a310d04ddbbfeee172df0f35512958b257e213ebce30c80aed39a5259fc64aef

Sharing

Copy URL Twitter E-mail

General

Target
a310d04ddbbfeee172df0f35512958b257e213ebce30c80aed39a5259fc64aef.exe
Size 45KB
Sample260701-pr6gdaes8j
SHA256 a310d04ddbbfeee172df0f35512958b257e213ebce30c80aed39a5259fc64aef
MD5 ba5c12d9ded434f7afa055bf7e795e56
SHA1 4e79becf770cde648df069c03e00d7c5fb3cb7c0
SHA512 e3d42635bb465b528ca6fa436fb3a0bc4eb329c628f809a945676add021f34431446213a2c63ea22656f32c29075dfffe79743f33fd43c7ba5f04906f730fe5f
SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQc3HE4SVoOPIGQzjbzgU3iBEx840F5WquGldBDZUx:cuqb5TrhG2oUZo3GQ3bsUSBExr0FzBdW
TLSH
T1E3232B003BE8812BF2BE4F7898F26145467AF2736603D58E1CC451DB5723BC69A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

madcityservers.com:80
madcityservers.com:22
madcityservers.com:8080
madcityservers.com:8880
madcityservers.com:2052
madcityservers.com:2082
madcityservers.com:2086
madcityservers.com:2095
madcityservers.com:443
madcityservers.com:2053
madcityservers.com:2083
madcityservers.com:2087
madcityservers.com:2096
madcityservers.com:8443
www.madcityservers.com:80
www.madcityservers.com:22
www.madcityservers.com:8080
www.madcityservers.com:8880
www.madcityservers.com:2052
www.madcityservers.com:2082
www.madcityservers.com:2086
www.madcityservers.com:2095
www.madcityservers.com:443
www.madcityservers.com:2053
www.madcityservers.com:2083
www.madcityservers.com:2087
www.madcityservers.com:2096
www.madcityservers.com:8443
stuxnet.madcityservers.com:80
stuxnet.madcityservers.com:22
stuxnet.madcityservers.com:8080
stuxnet.madcityservers.com:8880
stuxnet.madcityservers.com:2052
stuxnet.madcityservers.com:2082
stuxnet.madcityservers.com:2086
stuxnet.madcityservers.com:2095
stuxnet.madcityservers.com:443
stuxnet.madcityservers.com:2053
stuxnet.madcityservers.com:2083
stuxnet.madcityservers.com:2087
stuxnet.madcityservers.com:2096
stuxnet.madcityservers.com:8443
hermeticwiper.madcityservers.com:80
hermeticwiper.madcityservers.com:22
hermeticwiper.madcityservers.com:8080
hermeticwiper.madcityservers.com:8880
hermeticwiper.madcityservers.com:2052
hermeticwiper.madcityservers.com:2082
hermeticwiper.madcityservers.com:2086
hermeticwiper.madcityservers.com:2095
hermeticwiper.madcityservers.com:443
hermeticwiper.madcityservers.com:2053
hermeticwiper.madcityservers.com:2083
hermeticwiper.madcityservers.com:2087
hermeticwiper.madcityservers.com:2096
hermeticwiper.madcityservers.com:8443
malware.madcityservers.com:80
malware.madcityservers.com:22
malware.madcityservers.com:8080
malware.madcityservers.com:8880
malware.madcityservers.com:2052
malware.madcityservers.com:2082
malware.madcityservers.com:2086
malware.madcityservers.com:2095
malware.madcityservers.com:443
malware.madcityservers.com:2053
malware.madcityservers.com:2083
malware.madcityservers.com:2087
malware.madcityservers.com:2096
malware.madcityservers.com:8443

Mutex

s0hGupEwzIHN

Attributes

delay
0
install
true
install_file
3vqbm.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a310d04ddbbfeee172df0f35512958b257e213ebce30c80aed39a5259fc64aef.exe
- Size 45KB
- SHA256 a310d04ddbbfeee172df0f35512958b257e213ebce30c80aed39a5259fc64aef
- MD5 ba5c12d9ded434f7afa055bf7e795e56
- SHA1 4e79becf770cde648df069c03e00d7c5fb3cb7c0
- SHA512 e3d42635bb465b528ca6fa436fb3a0bc4eb329c628f809a945676add021f34431446213a2c63ea22656f32c29075dfffe79743f33fd43c7ba5f04906f730fe5f
- SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQc3HE4SVoOPIGQzjbzgU3iBEx840F5WquGldBDZUx:cuqb5TrhG2oUZo3GQ3bsUSBExr0FzBdW
- TLSH
  T1E3232B003BE8812BF2BE4F7898F26145467AF2736603D58E1CC451DB5723BC69A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2