asyncrat | 4e1e24dc6d365d2167266e6aa67dfe6810b3067d56973e53ddf9b659a479040d

Sharing

Copy URL Twitter E-mail

General

Target
4e1e24dc6d365d2167266e6aa67dfe6810b3067d56973e53ddf9b659a479040d
Size 45KB
Sample260703-ffwncsbv9w
SHA256 4e1e24dc6d365d2167266e6aa67dfe6810b3067d56973e53ddf9b659a479040d
MD5 ab382a7aa7234cc0f9558540248ecce6
SHA1 79bdedd3007b54ae4cfe7422be216a6cdcddde56
SHA512 bc813cbe9f65c3f23dbc702f4e64358ccff4e37abd08c8978e34b2f3434edc24bee5ce0279db42c6a70efa5d688e6ab7830d291d2eeebed86cb9ee1ea00a9b75
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7J6R8aI3OPIOzjb5g83ihX052q0+e1K5BDZ8x:0ushJTDXgH2o+FO3O3bW8Se2qY4d8x
TLSH
T16F232B0037D8812BF2BE4F78A9F26245867AF5633603D54E1CC4529B5613FC6DA42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

guidingelementsmc.com:80
guidingelementsmc.com:22
guidingelementsmc.com:8080
guidingelementsmc.com:8880
guidingelementsmc.com:2052
guidingelementsmc.com:2082
guidingelementsmc.com:2086
guidingelementsmc.com:2095
guidingelementsmc.com:443
guidingelementsmc.com:2053
guidingelementsmc.com:2083
guidingelementsmc.com:2087
guidingelementsmc.com:2096
guidingelementsmc.com:8443
www.guidingelementsmc.com:80
www.guidingelementsmc.com:22
www.guidingelementsmc.com:8080
www.guidingelementsmc.com:8880
www.guidingelementsmc.com:2052
www.guidingelementsmc.com:2082
www.guidingelementsmc.com:2086
www.guidingelementsmc.com:2095
www.guidingelementsmc.com:443
www.guidingelementsmc.com:2053
www.guidingelementsmc.com:2083
www.guidingelementsmc.com:2087
www.guidingelementsmc.com:2096
www.guidingelementsmc.com:8443
cl0p.guidingelementsmc.com:80
cl0p.guidingelementsmc.com:22
cl0p.guidingelementsmc.com:8080
cl0p.guidingelementsmc.com:8880
cl0p.guidingelementsmc.com:2052
cl0p.guidingelementsmc.com:2082
cl0p.guidingelementsmc.com:2086
cl0p.guidingelementsmc.com:2095
cl0p.guidingelementsmc.com:443
cl0p.guidingelementsmc.com:2053
cl0p.guidingelementsmc.com:2083
cl0p.guidingelementsmc.com:2087
cl0p.guidingelementsmc.com:2096
cl0p.guidingelementsmc.com:8443
ryuk.guidingelementsmc.com:80
ryuk.guidingelementsmc.com:22
ryuk.guidingelementsmc.com:8080
ryuk.guidingelementsmc.com:8880
ryuk.guidingelementsmc.com:2052
ryuk.guidingelementsmc.com:2082
ryuk.guidingelementsmc.com:2086
ryuk.guidingelementsmc.com:2095
ryuk.guidingelementsmc.com:443
ryuk.guidingelementsmc.com:2053
ryuk.guidingelementsmc.com:2083
ryuk.guidingelementsmc.com:2087
ryuk.guidingelementsmc.com:2096
ryuk.guidingelementsmc.com:8443
qbot.guidingelementsmc.com:80
qbot.guidingelementsmc.com:22
qbot.guidingelementsmc.com:8080
qbot.guidingelementsmc.com:8880
qbot.guidingelementsmc.com:2052
qbot.guidingelementsmc.com:2082
qbot.guidingelementsmc.com:2086
qbot.guidingelementsmc.com:2095
qbot.guidingelementsmc.com:443
qbot.guidingelementsmc.com:2053
qbot.guidingelementsmc.com:2083
qbot.guidingelementsmc.com:2087
qbot.guidingelementsmc.com:2096
qbot.guidingelementsmc.com:8443

Mutex

VPIb8wIoKB9A

Attributes

delay
0
install
true
install_file
44b26k.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4e1e24dc6d365d2167266e6aa67dfe6810b3067d56973e53ddf9b659a479040d
- Size 45KB
- SHA256 4e1e24dc6d365d2167266e6aa67dfe6810b3067d56973e53ddf9b659a479040d
- MD5 ab382a7aa7234cc0f9558540248ecce6
- SHA1 79bdedd3007b54ae4cfe7422be216a6cdcddde56
- SHA512 bc813cbe9f65c3f23dbc702f4e64358ccff4e37abd08c8978e34b2f3434edc24bee5ce0279db42c6a70efa5d688e6ab7830d291d2eeebed86cb9ee1ea00a9b75
- SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7J6R8aI3OPIOzjb5g83ihX052q0+e1K5BDZ8x:0ushJTDXgH2o+FO3O3bW8Se2qY4d8x
- TLSH
  T16F232B0037D8812BF2BE4F78A9F26245867AF5633603D54E1CC4529B5613FC6DA42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2