asyncrat | f6e5c1f61bf5e47104b1a306da6c59bc370610cdc483cb848045aceedaa339c7

Sharing

Copy URL Twitter E-mail

General

Target
f6e5c1f61bf5e47104b1a306da6c59bc370610cdc483cb848045aceedaa339c7
Size 45KB
Sample260703-llly1abv5j
SHA256 f6e5c1f61bf5e47104b1a306da6c59bc370610cdc483cb848045aceedaa339c7
MD5 4252727ab72f10e5e1c457520f7310e1
SHA1 40ae09915f224856c40cedddbb54225ff34e2842
SHA512 c9ad5cf8c3a75e2517418eceb6a41ae00f5e17b7516669f2ac7b23ee4a179572f9026dfabf3771dc51042904d5c303200e5fb428c9618883e1913f08a2657432
SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrzxJdxCPHuPIXzjb6gt3iU4Kusqpmk8Lcnk//BDZm:vuogpT7I62QZc3X3bttSNsqUkrnkBdkx
TLSH
T175232A003BE9812BF2BE4FB4A8F26145867AF5632603D64D2CC451DB5623FC6DA426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

golicolombia.com:80
golicolombia.com:22
golicolombia.com:8080
golicolombia.com:8880
golicolombia.com:2052
golicolombia.com:2082
golicolombia.com:2086
golicolombia.com:2095
golicolombia.com:443
golicolombia.com:2053
golicolombia.com:2083
golicolombia.com:2087
golicolombia.com:2096
golicolombia.com:8443
www.golicolombia.com:80
www.golicolombia.com:22
www.golicolombia.com:8080
www.golicolombia.com:8880
www.golicolombia.com:2052
www.golicolombia.com:2082
www.golicolombia.com:2086
www.golicolombia.com:2095
www.golicolombia.com:443
www.golicolombia.com:2053
www.golicolombia.com:2083
www.golicolombia.com:2087
www.golicolombia.com:2096
www.golicolombia.com:8443
client.golicolombia.com:80
client.golicolombia.com:22
client.golicolombia.com:8080
client.golicolombia.com:8880
client.golicolombia.com:2052
client.golicolombia.com:2082
client.golicolombia.com:2086
client.golicolombia.com:2095
client.golicolombia.com:443
client.golicolombia.com:2053
client.golicolombia.com:2083
client.golicolombia.com:2087
client.golicolombia.com:2096
client.golicolombia.com:8443
cl0p.golicolombia.com:80
cl0p.golicolombia.com:22
cl0p.golicolombia.com:8080
cl0p.golicolombia.com:8880
cl0p.golicolombia.com:2052
cl0p.golicolombia.com:2082
cl0p.golicolombia.com:2086
cl0p.golicolombia.com:2095
cl0p.golicolombia.com:443
cl0p.golicolombia.com:2053
cl0p.golicolombia.com:2083
cl0p.golicolombia.com:2087
cl0p.golicolombia.com:2096
cl0p.golicolombia.com:8443
locky.golicolombia.com:80
locky.golicolombia.com:22
locky.golicolombia.com:8080
locky.golicolombia.com:8880
locky.golicolombia.com:2052
locky.golicolombia.com:2082
locky.golicolombia.com:2086
locky.golicolombia.com:2095
locky.golicolombia.com:443
locky.golicolombia.com:2053
locky.golicolombia.com:2083
locky.golicolombia.com:2087
locky.golicolombia.com:2096
locky.golicolombia.com:8443
gozi.golicolombia.com:80
gozi.golicolombia.com:22
gozi.golicolombia.com:8080
gozi.golicolombia.com:8880
gozi.golicolombia.com:2052
gozi.golicolombia.com:2082
gozi.golicolombia.com:2086
gozi.golicolombia.com:2095
gozi.golicolombia.com:443
gozi.golicolombia.com:2053
gozi.golicolombia.com:2083
gozi.golicolombia.com:2087
gozi.golicolombia.com:2096
gozi.golicolombia.com:8443

Mutex

jzv4qeuFGFq8

Attributes

delay
0
install
true
install_file
xvhfomfl.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  f6e5c1f61bf5e47104b1a306da6c59bc370610cdc483cb848045aceedaa339c7
- Size 45KB
- SHA256 f6e5c1f61bf5e47104b1a306da6c59bc370610cdc483cb848045aceedaa339c7
- MD5 4252727ab72f10e5e1c457520f7310e1
- SHA1 40ae09915f224856c40cedddbb54225ff34e2842
- SHA512 c9ad5cf8c3a75e2517418eceb6a41ae00f5e17b7516669f2ac7b23ee4a179572f9026dfabf3771dc51042904d5c303200e5fb428c9618883e1913f08a2657432
- SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrzxJdxCPHuPIXzjb6gt3iU4Kusqpmk8Lcnk//BDZm:vuogpT7I62QZc3X3bttSNsqUkrnkBdkx
- TLSH
  T175232A003BE9812BF2BE4FB4A8F26145867AF5632603D64D2CC451DB5623FC6DA426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2