asyncrat | 3cbbc84064dc5e3be561c8fa99d7db5ef95d568ab38fb8ac5dbbf661a3b40442

Sharing

Copy URL Twitter E-mail

General

Target
3cbbc84064dc5e3be561c8fa99d7db5ef95d568ab38fb8ac5dbbf661a3b40442
Size 45KB
Sample260703-m2k73sfx6s
SHA256 3cbbc84064dc5e3be561c8fa99d7db5ef95d568ab38fb8ac5dbbf661a3b40442
MD5 f95b242c53914ca9da94ff3e7de0f54e
SHA1 7e1e628feb3401e888fb856b21b79c5e2b6a34e4
SHA512 bb97bf636d77a50e7bbf52643ef2d4daa67a3bc4b19189af0570504d917dce0b862d02868e68c3a03b1960092cae8f98b3f69033656a01e4508f584d0515078a
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9LrE7HLejpOPIItzjbxgX3ZzXO/c+SCyB+nk88BDZsx:EulCJTHl42sSCt3It3b+Xpzd+SoEdsx
TLSH
T17B230B003BD8C12BF27E4F7899F25145867AF6633603D64E1CC452DB5623FC69A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

myzoomboom.com:80
myzoomboom.com:22
myzoomboom.com:8080
myzoomboom.com:8880
myzoomboom.com:2052
myzoomboom.com:2082
myzoomboom.com:2086
myzoomboom.com:2095
myzoomboom.com:443
myzoomboom.com:2053
myzoomboom.com:2083
myzoomboom.com:2087
myzoomboom.com:2096
myzoomboom.com:8443
www.myzoomboom.com:80
www.myzoomboom.com:22
www.myzoomboom.com:8080
www.myzoomboom.com:8880
www.myzoomboom.com:2052
www.myzoomboom.com:2082
www.myzoomboom.com:2086
www.myzoomboom.com:2095
www.myzoomboom.com:443
www.myzoomboom.com:2053
www.myzoomboom.com:2083
www.myzoomboom.com:2087
www.myzoomboom.com:2096
www.myzoomboom.com:8443
remote.myzoomboom.com:80
remote.myzoomboom.com:22
remote.myzoomboom.com:8080
remote.myzoomboom.com:8880
remote.myzoomboom.com:2052
remote.myzoomboom.com:2082
remote.myzoomboom.com:2086
remote.myzoomboom.com:2095
remote.myzoomboom.com:443
remote.myzoomboom.com:2053
remote.myzoomboom.com:2083
remote.myzoomboom.com:2087
remote.myzoomboom.com:2096
remote.myzoomboom.com:8443
invasive.myzoomboom.com:80
invasive.myzoomboom.com:22
invasive.myzoomboom.com:8080
invasive.myzoomboom.com:8880
invasive.myzoomboom.com:2052
invasive.myzoomboom.com:2082
invasive.myzoomboom.com:2086
invasive.myzoomboom.com:2095
invasive.myzoomboom.com:443
invasive.myzoomboom.com:2053
invasive.myzoomboom.com:2083
invasive.myzoomboom.com:2087
invasive.myzoomboom.com:2096
invasive.myzoomboom.com:8443
mirai.myzoomboom.com:80
mirai.myzoomboom.com:22
mirai.myzoomboom.com:8080
mirai.myzoomboom.com:8880
mirai.myzoomboom.com:2052
mirai.myzoomboom.com:2082
mirai.myzoomboom.com:2086
mirai.myzoomboom.com:2095
mirai.myzoomboom.com:443
mirai.myzoomboom.com:2053
mirai.myzoomboom.com:2083
mirai.myzoomboom.com:2087
mirai.myzoomboom.com:2096
mirai.myzoomboom.com:8443

Mutex

xWLEmDJEm05z

Attributes

delay
0
install
true
install_file
my59kt.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  3cbbc84064dc5e3be561c8fa99d7db5ef95d568ab38fb8ac5dbbf661a3b40442
- Size 45KB
- SHA256 3cbbc84064dc5e3be561c8fa99d7db5ef95d568ab38fb8ac5dbbf661a3b40442
- MD5 f95b242c53914ca9da94ff3e7de0f54e
- SHA1 7e1e628feb3401e888fb856b21b79c5e2b6a34e4
- SHA512 bb97bf636d77a50e7bbf52643ef2d4daa67a3bc4b19189af0570504d917dce0b862d02868e68c3a03b1960092cae8f98b3f69033656a01e4508f584d0515078a
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9LrE7HLejpOPIItzjbxgX3ZzXO/c+SCyB+nk88BDZsx:EulCJTHl42sSCt3It3b+Xpzd+SoEdsx
- TLSH
  T17B230B003BD8C12BF27E4F7899F25145867AF6633603D64E1CC452DB5623FC69A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2