asyncrat | 3ab963c591e1a5a38941f0c038b46c4a94c7f877bc60bdacacc23f1ca2f110e8

Sharing

Copy URL Twitter E-mail

General

Target
3ab963c591e1a5a38941f0c038b46c4a94c7f877bc60bdacacc23f1ca2f110e8
Size 45KB
Sample260701-y4c52aes8p
SHA256 3ab963c591e1a5a38941f0c038b46c4a94c7f877bc60bdacacc23f1ca2f110e8
MD5 9d0afce73f2b9d6289752b53e06bcee0
SHA1 2918ebbe28f7273e9b72a33442d56cfe3fdbc3a1
SHA512 2b2789763c1efbc3bb4ed0fb20af0542b499b62d8cdb34fdffec84e52fb7f1886903749dd0b43b7be4e5a446903e18fef74a4f4e55b9d3760f29e984c5cb7b5e
SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qryL5P02FUFdxYkk8PIQzjbSgX3iMg8RgGtlsSvJBDZ2:ruKQpTAOX2FLDmWBQ3bVXSMVmGtlBd0x
TLSH
T1EA230A003BE9812BF2BE4F7468F26245867AF6732603D5491CC451DB5B13FC69A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

madcityservers.com:80
madcityservers.com:22
madcityservers.com:8080
madcityservers.com:8880
madcityservers.com:2052
madcityservers.com:2082
madcityservers.com:2086
madcityservers.com:2095
madcityservers.com:443
madcityservers.com:2053
madcityservers.com:2083
madcityservers.com:2087
madcityservers.com:2096
madcityservers.com:8443
www.madcityservers.com:80
www.madcityservers.com:22
www.madcityservers.com:8080
www.madcityservers.com:8880
www.madcityservers.com:2052
www.madcityservers.com:2082
www.madcityservers.com:2086
www.madcityservers.com:2095
www.madcityservers.com:443
www.madcityservers.com:2053
www.madcityservers.com:2083
www.madcityservers.com:2087
www.madcityservers.com:2096
www.madcityservers.com:8443
notpetya.madcityservers.com:80
notpetya.madcityservers.com:22
notpetya.madcityservers.com:8080
notpetya.madcityservers.com:8880
notpetya.madcityservers.com:2052
notpetya.madcityservers.com:2082
notpetya.madcityservers.com:2086
notpetya.madcityservers.com:2095
notpetya.madcityservers.com:443
notpetya.madcityservers.com:2053
notpetya.madcityservers.com:2083
notpetya.madcityservers.com:2087
notpetya.madcityservers.com:2096
notpetya.madcityservers.com:8443
malware.madcityservers.com:80
malware.madcityservers.com:22
malware.madcityservers.com:8080
malware.madcityservers.com:8880
malware.madcityservers.com:2052
malware.madcityservers.com:2082
malware.madcityservers.com:2086
malware.madcityservers.com:2095
malware.madcityservers.com:443
malware.madcityservers.com:2053
malware.madcityservers.com:2083
malware.madcityservers.com:2087
malware.madcityservers.com:2096
malware.madcityservers.com:8443
remcos.madcityservers.com:80
remcos.madcityservers.com:22
remcos.madcityservers.com:8080
remcos.madcityservers.com:8880
remcos.madcityservers.com:2052
remcos.madcityservers.com:2082
remcos.madcityservers.com:2086
remcos.madcityservers.com:2095
remcos.madcityservers.com:443
remcos.madcityservers.com:2053
remcos.madcityservers.com:2083
remcos.madcityservers.com:2087
remcos.madcityservers.com:2096
remcos.madcityservers.com:8443
hack.madcityservers.com:80
hack.madcityservers.com:22
hack.madcityservers.com:8080
hack.madcityservers.com:8880
hack.madcityservers.com:2052
hack.madcityservers.com:2082
hack.madcityservers.com:2086
hack.madcityservers.com:2095
hack.madcityservers.com:443
hack.madcityservers.com:2053
hack.madcityservers.com:2083
hack.madcityservers.com:2087
hack.madcityservers.com:2096
hack.madcityservers.com:8443

Mutex

ufGaKQjFNvI6

Attributes

delay
0
install
true
install_file
ofy2.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  3ab963c591e1a5a38941f0c038b46c4a94c7f877bc60bdacacc23f1ca2f110e8
- Size 45KB
- SHA256 3ab963c591e1a5a38941f0c038b46c4a94c7f877bc60bdacacc23f1ca2f110e8
- MD5 9d0afce73f2b9d6289752b53e06bcee0
- SHA1 2918ebbe28f7273e9b72a33442d56cfe3fdbc3a1
- SHA512 2b2789763c1efbc3bb4ed0fb20af0542b499b62d8cdb34fdffec84e52fb7f1886903749dd0b43b7be4e5a446903e18fef74a4f4e55b9d3760f29e984c5cb7b5e
- SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qryL5P02FUFdxYkk8PIQzjbSgX3iMg8RgGtlsSvJBDZ2:ruKQpTAOX2FLDmWBQ3bVXSMVmGtlBd0x
- TLSH
  T1EA230A003BE9812BF2BE4F7468F26245867AF6732603D5491CC451DB5B13FC69A42AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2