asyncrat | 6d6ed6a9b330f610d9f047e63fed86caad3ba1c31606a217f745192b35bfa8ad

Sharing

Copy URL Twitter E-mail

General

Target
6d6ed6a9b330f610d9f047e63fed86caad3ba1c31606a217f745192b35bfa8ad
Size 45KB
Sample260703-ees1eabs3s
SHA256 6d6ed6a9b330f610d9f047e63fed86caad3ba1c31606a217f745192b35bfa8ad
MD5 34156efc70256c2f4281e8f71ba475f3
SHA1 81d042a52ab08b1ef2d5d19ab42d69f51eac452c
SHA512 9cd4198697ee8fafba1f6f606b884f043a4423e83cf7e1818cdf6b651459600ff055904d50d805ba7cfd82dfc0dd5a8ddf366cff4dd5c1a77e4c168da4d3b79e
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFUlsNoPEaMPIccjb5gX3iFEx39tuz8YXHuBDZEx:MuLAZTnbg2tsuEaxcsbWXSFEx39tuoCL
TLSH
T1C3232A003BE8822BF2BE4FB898F26145867AF6737603D5491CC451975A23FC696426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

golicolombia.com:80
golicolombia.com:22
golicolombia.com:8080
golicolombia.com:8880
golicolombia.com:2052
golicolombia.com:2082
golicolombia.com:2086
golicolombia.com:2095
golicolombia.com:443
golicolombia.com:2053
golicolombia.com:2083
golicolombia.com:2087
golicolombia.com:2096
golicolombia.com:8443
www.golicolombia.com:80
www.golicolombia.com:22
www.golicolombia.com:8080
www.golicolombia.com:8880
www.golicolombia.com:2052
www.golicolombia.com:2082
www.golicolombia.com:2086
www.golicolombia.com:2095
www.golicolombia.com:443
www.golicolombia.com:2053
www.golicolombia.com:2083
www.golicolombia.com:2087
www.golicolombia.com:2096
www.golicolombia.com:8443
cryptolocker.golicolombia.com:80
cryptolocker.golicolombia.com:22
cryptolocker.golicolombia.com:8080
cryptolocker.golicolombia.com:8880
cryptolocker.golicolombia.com:2052
cryptolocker.golicolombia.com:2082
cryptolocker.golicolombia.com:2086
cryptolocker.golicolombia.com:2095
cryptolocker.golicolombia.com:443
cryptolocker.golicolombia.com:2053
cryptolocker.golicolombia.com:2083
cryptolocker.golicolombia.com:2087
cryptolocker.golicolombia.com:2096
cryptolocker.golicolombia.com:8443
klez.golicolombia.com:80
klez.golicolombia.com:22
klez.golicolombia.com:8080
klez.golicolombia.com:8880
klez.golicolombia.com:2052
klez.golicolombia.com:2082
klez.golicolombia.com:2086
klez.golicolombia.com:2095
klez.golicolombia.com:443
klez.golicolombia.com:2053
klez.golicolombia.com:2083
klez.golicolombia.com:2087
klez.golicolombia.com:2096
klez.golicolombia.com:8443
rat.golicolombia.com:80
rat.golicolombia.com:22
rat.golicolombia.com:8080
rat.golicolombia.com:8880
rat.golicolombia.com:2052
rat.golicolombia.com:2082
rat.golicolombia.com:2086
rat.golicolombia.com:2095
rat.golicolombia.com:443
rat.golicolombia.com:2053
rat.golicolombia.com:2083
rat.golicolombia.com:2087
rat.golicolombia.com:2096
rat.golicolombia.com:8443

Mutex

LSD6vbj417Fw

Attributes

delay
0
install
true
install_file
tiipc.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6d6ed6a9b330f610d9f047e63fed86caad3ba1c31606a217f745192b35bfa8ad
- Size 45KB
- SHA256 6d6ed6a9b330f610d9f047e63fed86caad3ba1c31606a217f745192b35bfa8ad
- MD5 34156efc70256c2f4281e8f71ba475f3
- SHA1 81d042a52ab08b1ef2d5d19ab42d69f51eac452c
- SHA512 9cd4198697ee8fafba1f6f606b884f043a4423e83cf7e1818cdf6b651459600ff055904d50d805ba7cfd82dfc0dd5a8ddf366cff4dd5c1a77e4c168da4d3b79e
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFUlsNoPEaMPIccjb5gX3iFEx39tuz8YXHuBDZEx:MuLAZTnbg2tsuEaxcsbWXSFEx39tuoCL
- TLSH
  T1C3232A003BE8822BF2BE4FB898F26145867AF6737603D5491CC451975A23FC696426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2