asyncrat | 343cc631576485da0982cf3f6954a9c763ecdc1890d1562ed70951b8d73ff9ab

Sharing

Copy URL Twitter E-mail

General

Target
343cc631576485da0982cf3f6954a9c763ecdc1890d1562ed70951b8d73ff9ab
Size 45KB
Sample260701-rywlvsh161
SHA256 343cc631576485da0982cf3f6954a9c763ecdc1890d1562ed70951b8d73ff9ab
MD5 ac6d59c08b9301530ea602ba4fcfa417
SHA1 5fd571ef9e4a795f61803cf370f60981810a076a
SHA512 6030d5df64fff81f1724d8483079b46a2186148436885fc0ea0de1c08b926ec41ee99d9770251030016882866c50a9cff685a97555d9662e008aab484b5193e6
SSDEEP 768:rukO5TkI7ZzWUTZ9Fmo2qTMSAFcKoabbb4ZhM/RPIAEzjbdgX3iSh+fKwbnpjBDg:rukO5TkUH2lSAvQZh6OAE3bKXSSEKaT0
TLSH
T145232A003BE8C12BF2BF4F7899F26145867AF2633603D59A1CC4519B5713FC696426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

istanbulozelegitim.net:80
istanbulozelegitim.net:22
istanbulozelegitim.net:8080
istanbulozelegitim.net:8880
istanbulozelegitim.net:2052
istanbulozelegitim.net:2082
istanbulozelegitim.net:2086
istanbulozelegitim.net:2095
istanbulozelegitim.net:443
istanbulozelegitim.net:2053
istanbulozelegitim.net:2083
istanbulozelegitim.net:2087
istanbulozelegitim.net:2096
istanbulozelegitim.net:8443
www.istanbulozelegitim.net:80
www.istanbulozelegitim.net:22
www.istanbulozelegitim.net:8080
www.istanbulozelegitim.net:8880
www.istanbulozelegitim.net:2052
www.istanbulozelegitim.net:2082
www.istanbulozelegitim.net:2086
www.istanbulozelegitim.net:2095
www.istanbulozelegitim.net:443
www.istanbulozelegitim.net:2053
www.istanbulozelegitim.net:2083
www.istanbulozelegitim.net:2087
www.istanbulozelegitim.net:2096
www.istanbulozelegitim.net:8443
malware.istanbulozelegitim.net:80
malware.istanbulozelegitim.net:22
malware.istanbulozelegitim.net:8080
malware.istanbulozelegitim.net:8880
malware.istanbulozelegitim.net:2052
malware.istanbulozelegitim.net:2082
malware.istanbulozelegitim.net:2086
malware.istanbulozelegitim.net:2095
malware.istanbulozelegitim.net:443
malware.istanbulozelegitim.net:2053
malware.istanbulozelegitim.net:2083
malware.istanbulozelegitim.net:2087
malware.istanbulozelegitim.net:2096
malware.istanbulozelegitim.net:8443
sodinokibi.istanbulozelegitim.net:80
sodinokibi.istanbulozelegitim.net:22
sodinokibi.istanbulozelegitim.net:8080
sodinokibi.istanbulozelegitim.net:8880
sodinokibi.istanbulozelegitim.net:2052
sodinokibi.istanbulozelegitim.net:2082
sodinokibi.istanbulozelegitim.net:2086
sodinokibi.istanbulozelegitim.net:2095
sodinokibi.istanbulozelegitim.net:443
sodinokibi.istanbulozelegitim.net:2053
sodinokibi.istanbulozelegitim.net:2083
sodinokibi.istanbulozelegitim.net:2087
sodinokibi.istanbulozelegitim.net:2096
sodinokibi.istanbulozelegitim.net:8443
iloveyou.istanbulozelegitim.net:80
iloveyou.istanbulozelegitim.net:22
iloveyou.istanbulozelegitim.net:8080
iloveyou.istanbulozelegitim.net:8880
iloveyou.istanbulozelegitim.net:2052
iloveyou.istanbulozelegitim.net:2082
iloveyou.istanbulozelegitim.net:2086
iloveyou.istanbulozelegitim.net:2095
iloveyou.istanbulozelegitim.net:443
iloveyou.istanbulozelegitim.net:2053
iloveyou.istanbulozelegitim.net:2083
iloveyou.istanbulozelegitim.net:2087
iloveyou.istanbulozelegitim.net:2096
iloveyou.istanbulozelegitim.net:8443

Mutex

9oaayTgxCAXV

Attributes

delay
0
install
true
install_file
mprxz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  343cc631576485da0982cf3f6954a9c763ecdc1890d1562ed70951b8d73ff9ab
- Size 45KB
- SHA256 343cc631576485da0982cf3f6954a9c763ecdc1890d1562ed70951b8d73ff9ab
- MD5 ac6d59c08b9301530ea602ba4fcfa417
- SHA1 5fd571ef9e4a795f61803cf370f60981810a076a
- SHA512 6030d5df64fff81f1724d8483079b46a2186148436885fc0ea0de1c08b926ec41ee99d9770251030016882866c50a9cff685a97555d9662e008aab484b5193e6
- SSDEEP 768:rukO5TkI7ZzWUTZ9Fmo2qTMSAFcKoabbb4ZhM/RPIAEzjbdgX3iSh+fKwbnpjBDg:rukO5TkUH2lSAvQZh6OAE3bKXSSEKaT0
- TLSH
  T145232A003BE8C12BF2BF4F7899F26145867AF2633603D59A1CC4519B5713FC696426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2