asyncrat | 78a35fe9cd08df7fef5a223f88a8fae788d128d1fca1ac4d259ba1a03085547b

Sharing

Copy URL Twitter E-mail

General

Target
78a35fe9cd08df7fef5a223f88a8fae788d128d1fca1ac4d259ba1a03085547b.exe
Size 45KB
Sample260703-eflmqabs3w
SHA256 78a35fe9cd08df7fef5a223f88a8fae788d128d1fca1ac4d259ba1a03085547b
MD5 f342aebf66123f1ca2d4f6478c2ab9f8
SHA1 ddd5f4fa530274eafc94bfc897970d7a96f12ab4
SHA512 ed139147a38b8d0a8715a3d0d1452c44cda441c9d9d036ddb83e081ae2b2a16522ddb4c38e796c6e6e69b37ad6627c57325312acdcd2db53372606a092e77fea
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YSkqXzNOPISzjb7gs3ii1egQkXx+3nrxBDZsx:EufspTf2g2maVq3S3bEsSi0lI+3nrPdu
TLSH
T12B23190037EDC12BF2BE4F7899F26145867AF2632603D64A1CC452DB5613FC68A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

golicolombia.com:80
golicolombia.com:22
golicolombia.com:8080
golicolombia.com:8880
golicolombia.com:2052
golicolombia.com:2082
golicolombia.com:2086
golicolombia.com:2095
golicolombia.com:443
golicolombia.com:2053
golicolombia.com:2083
golicolombia.com:2087
golicolombia.com:2096
golicolombia.com:8443
www.golicolombia.com:80
www.golicolombia.com:22
www.golicolombia.com:8080
www.golicolombia.com:8880
www.golicolombia.com:2052
www.golicolombia.com:2082
www.golicolombia.com:2086
www.golicolombia.com:2095
www.golicolombia.com:443
www.golicolombia.com:2053
www.golicolombia.com:2083
www.golicolombia.com:2087
www.golicolombia.com:2096
www.golicolombia.com:8443
gh0st.golicolombia.com:80
gh0st.golicolombia.com:22
gh0st.golicolombia.com:8080
gh0st.golicolombia.com:8880
gh0st.golicolombia.com:2052
gh0st.golicolombia.com:2082
gh0st.golicolombia.com:2086
gh0st.golicolombia.com:2095
gh0st.golicolombia.com:443
gh0st.golicolombia.com:2053
gh0st.golicolombia.com:2083
gh0st.golicolombia.com:2087
gh0st.golicolombia.com:2096
gh0st.golicolombia.com:8443
nimda.golicolombia.com:80
nimda.golicolombia.com:22
nimda.golicolombia.com:8080
nimda.golicolombia.com:8880
nimda.golicolombia.com:2052
nimda.golicolombia.com:2082
nimda.golicolombia.com:2086
nimda.golicolombia.com:2095
nimda.golicolombia.com:443
nimda.golicolombia.com:2053
nimda.golicolombia.com:2083
nimda.golicolombia.com:2087
nimda.golicolombia.com:2096
nimda.golicolombia.com:8443
hack.golicolombia.com:80
hack.golicolombia.com:22
hack.golicolombia.com:8080
hack.golicolombia.com:8880
hack.golicolombia.com:2052
hack.golicolombia.com:2082
hack.golicolombia.com:2086
hack.golicolombia.com:2095
hack.golicolombia.com:443
hack.golicolombia.com:2053
hack.golicolombia.com:2083
hack.golicolombia.com:2087
hack.golicolombia.com:2096
hack.golicolombia.com:8443

Mutex

BIbciKecVkLJ

Attributes

delay
0
install
true
install_file
ii007pj.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  78a35fe9cd08df7fef5a223f88a8fae788d128d1fca1ac4d259ba1a03085547b.exe
- Size 45KB
- SHA256 78a35fe9cd08df7fef5a223f88a8fae788d128d1fca1ac4d259ba1a03085547b
- MD5 f342aebf66123f1ca2d4f6478c2ab9f8
- SHA1 ddd5f4fa530274eafc94bfc897970d7a96f12ab4
- SHA512 ed139147a38b8d0a8715a3d0d1452c44cda441c9d9d036ddb83e081ae2b2a16522ddb4c38e796c6e6e69b37ad6627c57325312acdcd2db53372606a092e77fea
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YSkqXzNOPISzjb7gs3ii1egQkXx+3nrxBDZsx:EufspTf2g2maVq3S3bEsSi0lI+3nrPdu
- TLSH
  T12B23190037EDC12BF2BE4F7899F26145867AF2632603D64A1CC452DB5613FC68A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2