asyncrat | a9a4a3445b7143e431d37a9869c45cbbc96726b7fdb463955a0f35916d61be27

Sharing

Copy URL Twitter E-mail

General

Target
a9a4a3445b7143e431d37a9869c45cbbc96726b7fdb463955a0f35916d61be27
Size 45KB
Sample260701-qtel4sft3m
SHA256 a9a4a3445b7143e431d37a9869c45cbbc96726b7fdb463955a0f35916d61be27
MD5 31f1144c631ad3bab9186a823da46f7e
SHA1 f015519a99cd92a2bf98795e2f72d1cf2bc08c45
SHA512 bd42159b6c1fdd86bd154cd93196e9f9e697e0a08b5ab1470e2d1a79e0c5760d04997265c121ead550a78a00a4977ea2a7d08e327caab5a8cd554dc0e245934e
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qANcP0pycvHPIjzjbzgX3inYpro3Ipk4BDZUx:cuqNJTLr62dccMcvgj3bsXSUraIpk+dW
TLSH
T16A2319003BE8813BF2BE4F74A8F26145867AF6633603D6491CC4529B5623FC6DA426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

istanbulozelegitim.net:80
istanbulozelegitim.net:22
istanbulozelegitim.net:8080
istanbulozelegitim.net:8880
istanbulozelegitim.net:2052
istanbulozelegitim.net:2082
istanbulozelegitim.net:2086
istanbulozelegitim.net:2095
istanbulozelegitim.net:443
istanbulozelegitim.net:2053
istanbulozelegitim.net:2083
istanbulozelegitim.net:2087
istanbulozelegitim.net:2096
istanbulozelegitim.net:8443
www.istanbulozelegitim.net:80
www.istanbulozelegitim.net:22
www.istanbulozelegitim.net:8080
www.istanbulozelegitim.net:8880
www.istanbulozelegitim.net:2052
www.istanbulozelegitim.net:2082
www.istanbulozelegitim.net:2086
www.istanbulozelegitim.net:2095
www.istanbulozelegitim.net:443
www.istanbulozelegitim.net:2053
www.istanbulozelegitim.net:2083
www.istanbulozelegitim.net:2087
www.istanbulozelegitim.net:2096
www.istanbulozelegitim.net:8443
sodinokibi.istanbulozelegitim.net:80
sodinokibi.istanbulozelegitim.net:22
sodinokibi.istanbulozelegitim.net:8080
sodinokibi.istanbulozelegitim.net:8880
sodinokibi.istanbulozelegitim.net:2052
sodinokibi.istanbulozelegitim.net:2082
sodinokibi.istanbulozelegitim.net:2086
sodinokibi.istanbulozelegitim.net:2095
sodinokibi.istanbulozelegitim.net:443
sodinokibi.istanbulozelegitim.net:2053
sodinokibi.istanbulozelegitim.net:2083
sodinokibi.istanbulozelegitim.net:2087
sodinokibi.istanbulozelegitim.net:2096
sodinokibi.istanbulozelegitim.net:8443
blaster.istanbulozelegitim.net:80
blaster.istanbulozelegitim.net:22
blaster.istanbulozelegitim.net:8080
blaster.istanbulozelegitim.net:8880
blaster.istanbulozelegitim.net:2052
blaster.istanbulozelegitim.net:2082
blaster.istanbulozelegitim.net:2086
blaster.istanbulozelegitim.net:2095
blaster.istanbulozelegitim.net:443
blaster.istanbulozelegitim.net:2053
blaster.istanbulozelegitim.net:2083
blaster.istanbulozelegitim.net:2087
blaster.istanbulozelegitim.net:2096
blaster.istanbulozelegitim.net:8443
rat.istanbulozelegitim.net:80
rat.istanbulozelegitim.net:22
rat.istanbulozelegitim.net:8080
rat.istanbulozelegitim.net:8880
rat.istanbulozelegitim.net:2052
rat.istanbulozelegitim.net:2082
rat.istanbulozelegitim.net:2086
rat.istanbulozelegitim.net:2095
rat.istanbulozelegitim.net:443
rat.istanbulozelegitim.net:2053
rat.istanbulozelegitim.net:2083
rat.istanbulozelegitim.net:2087
rat.istanbulozelegitim.net:2096
rat.istanbulozelegitim.net:8443

Mutex

17RVchZ9j6fy

Attributes

delay
0
install
true
install_file
zgxz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a9a4a3445b7143e431d37a9869c45cbbc96726b7fdb463955a0f35916d61be27
- Size 45KB
- SHA256 a9a4a3445b7143e431d37a9869c45cbbc96726b7fdb463955a0f35916d61be27
- MD5 31f1144c631ad3bab9186a823da46f7e
- SHA1 f015519a99cd92a2bf98795e2f72d1cf2bc08c45
- SHA512 bd42159b6c1fdd86bd154cd93196e9f9e697e0a08b5ab1470e2d1a79e0c5760d04997265c121ead550a78a00a4977ea2a7d08e327caab5a8cd554dc0e245934e
- SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qANcP0pycvHPIjzjbzgX3inYpro3Ipk4BDZUx:cuqNJTLr62dccMcvgj3bsXSUraIpk+dW
- TLSH
  T16A2319003BE8813BF2BE4F74A8F26145867AF6633603D6491CC4529B5623FC6DA426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2