asyncrat | d87ae9b1207ce671805ee6b1a425a94f64f48808a8e8b76709b80dac6049b0c4

Sharing

Copy URL Twitter E-mail

General

Target
d87ae9b1207ce671805ee6b1a425a94f64f48808a8e8b76709b80dac6049b0c4
Size 45KB
Sample260703-mb6fbsct3n
SHA256 d87ae9b1207ce671805ee6b1a425a94f64f48808a8e8b76709b80dac6049b0c4
MD5 1fb360e165298f1da263ad3a995f1b11
SHA1 c3706ec74ce24d149baf9dd704bea9765effba30
SHA512 6d3f981745c879dacb37c761e89b72db0669bbb190fc864f53092270e6e0eb3b9212ac1d6e44a6f26c2a8966d5e5a1c728fafd78e54668052a0421c8a68fb197
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwvNd3u40cMOPI08zjbcgXbi+190MsWLk9W2n4BDZMx:ku40ZTXEb2J8+M3083bzX2FOk99+dMx
TLSH
T1F9232A003BE8812BF2BE4F7898F26145867AF5736603D94E1CC452DB5623FC68A526FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

golicolombia.com:80
golicolombia.com:22
golicolombia.com:8080
golicolombia.com:8880
golicolombia.com:2052
golicolombia.com:2082
golicolombia.com:2086
golicolombia.com:2095
golicolombia.com:443
golicolombia.com:2053
golicolombia.com:2083
golicolombia.com:2087
golicolombia.com:2096
golicolombia.com:8443
www.golicolombia.com:80
www.golicolombia.com:22
www.golicolombia.com:8080
www.golicolombia.com:8880
www.golicolombia.com:2052
www.golicolombia.com:2082
www.golicolombia.com:2086
www.golicolombia.com:2095
www.golicolombia.com:443
www.golicolombia.com:2053
www.golicolombia.com:2083
www.golicolombia.com:2087
www.golicolombia.com:2096
www.golicolombia.com:8443
ursnif.golicolombia.com:80
ursnif.golicolombia.com:22
ursnif.golicolombia.com:8080
ursnif.golicolombia.com:8880
ursnif.golicolombia.com:2052
ursnif.golicolombia.com:2082
ursnif.golicolombia.com:2086
ursnif.golicolombia.com:2095
ursnif.golicolombia.com:443
ursnif.golicolombia.com:2053
ursnif.golicolombia.com:2083
ursnif.golicolombia.com:2087
ursnif.golicolombia.com:2096
ursnif.golicolombia.com:8443
remcos.golicolombia.com:80
remcos.golicolombia.com:22
remcos.golicolombia.com:8080
remcos.golicolombia.com:8880
remcos.golicolombia.com:2052
remcos.golicolombia.com:2082
remcos.golicolombia.com:2086
remcos.golicolombia.com:2095
remcos.golicolombia.com:443
remcos.golicolombia.com:2053
remcos.golicolombia.com:2083
remcos.golicolombia.com:2087
remcos.golicolombia.com:2096
remcos.golicolombia.com:8443
agenttesla.golicolombia.com:80
agenttesla.golicolombia.com:22
agenttesla.golicolombia.com:8080
agenttesla.golicolombia.com:8880
agenttesla.golicolombia.com:2052
agenttesla.golicolombia.com:2082
agenttesla.golicolombia.com:2086
agenttesla.golicolombia.com:2095
agenttesla.golicolombia.com:443
agenttesla.golicolombia.com:2053
agenttesla.golicolombia.com:2083
agenttesla.golicolombia.com:2087
agenttesla.golicolombia.com:2096
agenttesla.golicolombia.com:8443

Mutex

HAMGV1q1FHa7

Attributes

delay
0
install
true
install_file
ejivp.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  d87ae9b1207ce671805ee6b1a425a94f64f48808a8e8b76709b80dac6049b0c4
- Size 45KB
- SHA256 d87ae9b1207ce671805ee6b1a425a94f64f48808a8e8b76709b80dac6049b0c4
- MD5 1fb360e165298f1da263ad3a995f1b11
- SHA1 c3706ec74ce24d149baf9dd704bea9765effba30
- SHA512 6d3f981745c879dacb37c761e89b72db0669bbb190fc864f53092270e6e0eb3b9212ac1d6e44a6f26c2a8966d5e5a1c728fafd78e54668052a0421c8a68fb197
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwvNd3u40cMOPI08zjbcgXbi+190MsWLk9W2n4BDZMx:ku40ZTXEb2J8+M3083bzX2FOk99+dMx
- TLSH
  T1F9232A003BE8812BF2BE4F7898F26145867AF5736603D94E1CC452DB5623FC68A526FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2