asyncrat | 168f055aa5e15d3b4e20612ceb361280a813a8df3d351918c9367f3950d7806c

Sharing

Copy URL Twitter E-mail

General

Target
tmpjohegd1_
Size 45KB
Sample260702-rheneafx3s
SHA256 168f055aa5e15d3b4e20612ceb361280a813a8df3d351918c9367f3950d7806c
MD5 d93127233931c8c78fb433c8786c3ac0
SHA1 bb1b67488f04c3cfc1b1cc14f4e0246dd93212b4
SHA512 f597f0f56534ad705caccb6f5c54e7a277938bb05aeb78e7b9700b526b80e894131bfc9bab5d083d27204cc6047e419a393d3521459082b748c04abaf414d02a
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE0yFjrdj3kk8PIhujbjgX3i/JcIhjTwRbCFdSB8:kuSOpTPOP2KLBXDBhCb8XS/mWTwROcdO
TLSH
T12E232A0037E9812BF2BE4F78A8F26245467AF5633603D6491CC451DB5B23FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

horaxhora.com:80
horaxhora.com:22
horaxhora.com:8080
horaxhora.com:8880
horaxhora.com:2052
horaxhora.com:2082
horaxhora.com:2086
horaxhora.com:2095
horaxhora.com:443
horaxhora.com:2053
horaxhora.com:2083
horaxhora.com:2087
horaxhora.com:2096
horaxhora.com:8443
www.horaxhora.com:80
www.horaxhora.com:22
www.horaxhora.com:8080
www.horaxhora.com:8880
www.horaxhora.com:2052
www.horaxhora.com:2082
www.horaxhora.com:2086
www.horaxhora.com:2095
www.horaxhora.com:443
www.horaxhora.com:2053
www.horaxhora.com:2083
www.horaxhora.com:2087
www.horaxhora.com:2096
www.horaxhora.com:8443
remcos.horaxhora.com:80
remcos.horaxhora.com:22
remcos.horaxhora.com:8080
remcos.horaxhora.com:8880
remcos.horaxhora.com:2052
remcos.horaxhora.com:2082
remcos.horaxhora.com:2086
remcos.horaxhora.com:2095
remcos.horaxhora.com:443
remcos.horaxhora.com:2053
remcos.horaxhora.com:2083
remcos.horaxhora.com:2087
remcos.horaxhora.com:2096
remcos.horaxhora.com:8443
lokibot.horaxhora.com:80
lokibot.horaxhora.com:22
lokibot.horaxhora.com:8080
lokibot.horaxhora.com:8880
lokibot.horaxhora.com:2052
lokibot.horaxhora.com:2082
lokibot.horaxhora.com:2086
lokibot.horaxhora.com:2095
lokibot.horaxhora.com:443
lokibot.horaxhora.com:2053
lokibot.horaxhora.com:2083
lokibot.horaxhora.com:2087
lokibot.horaxhora.com:2096
lokibot.horaxhora.com:8443
conti.horaxhora.com:80
conti.horaxhora.com:22
conti.horaxhora.com:8080
conti.horaxhora.com:8880
conti.horaxhora.com:2052
conti.horaxhora.com:2082
conti.horaxhora.com:2086
conti.horaxhora.com:2095
conti.horaxhora.com:443
conti.horaxhora.com:2053
conti.horaxhora.com:2083
conti.horaxhora.com:2087
conti.horaxhora.com:2096
conti.horaxhora.com:8443
nanocore.horaxhora.com:80
nanocore.horaxhora.com:22
nanocore.horaxhora.com:8080
nanocore.horaxhora.com:8880
nanocore.horaxhora.com:2052
nanocore.horaxhora.com:2082
nanocore.horaxhora.com:2086
nanocore.horaxhora.com:2095
nanocore.horaxhora.com:443
nanocore.horaxhora.com:2053
nanocore.horaxhora.com:2083
nanocore.horaxhora.com:2087
nanocore.horaxhora.com:2096
nanocore.horaxhora.com:8443

Mutex

UjDH2hKfTd1s

Attributes

delay
0
install
true
install_file
p2h9.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  tmpjohegd1_
- Size 45KB
- SHA256 168f055aa5e15d3b4e20612ceb361280a813a8df3d351918c9367f3950d7806c
- MD5 d93127233931c8c78fb433c8786c3ac0
- SHA1 bb1b67488f04c3cfc1b1cc14f4e0246dd93212b4
- SHA512 f597f0f56534ad705caccb6f5c54e7a277938bb05aeb78e7b9700b526b80e894131bfc9bab5d083d27204cc6047e419a393d3521459082b748c04abaf414d02a
- SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE0yFjrdj3kk8PIhujbjgX3i/JcIhjTwRbCFdSB8:kuSOpTPOP2KLBXDBhCb8XS/mWTwROcdO
- TLSH
  T12E232A0037E9812BF2BE4F78A8F26245467AF5633603D6491CC451DB5B23FC69A42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2 behavioral3