asyncrat | 45d39718f956c7696f31986551fbd4cc83886eeab6b06a627c42f0acb938405a

Sharing

Copy URL Twitter E-mail

General

Target
45d39718f956c7696f31986551fbd4cc83886eeab6b06a627c42f0acb938405a
Size 45KB
Sample260703-mb94hsct3p
SHA256 45d39718f956c7696f31986551fbd4cc83886eeab6b06a627c42f0acb938405a
MD5 ab33f7f43fd638e295c9b8c1d7a26019
SHA1 e11033ce2f32b365a90eab6f7a5f23ee6709b7e2
SHA512 1180f74c9d29dec216de35f66c7901820092e9261494dc904dd01a770b9ada7fc1b66ae62934ba14b4e0b226cbc5df19d76d13a3515b4654cd0547969f1acae7
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtDc30oiZPI/zjbggX3iKkx0sxKHy+pj9Jr+BE:MuBGJTPho2twR2iW/3bHXSKF1rpP8dEx
TLSH
T168232A003BE9C12BF2BE4F7498F26245867AF6633603D5491CC451DB5A13FC69A43AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chickengeeks.com:80
chickengeeks.com:22
chickengeeks.com:8080
chickengeeks.com:8880
chickengeeks.com:2052
chickengeeks.com:2082
chickengeeks.com:2086
chickengeeks.com:2095
chickengeeks.com:443
chickengeeks.com:2053
chickengeeks.com:2083
chickengeeks.com:2087
chickengeeks.com:2096
chickengeeks.com:8443
www.chickengeeks.com:80
www.chickengeeks.com:22
www.chickengeeks.com:8080
www.chickengeeks.com:8880
www.chickengeeks.com:2052
www.chickengeeks.com:2082
www.chickengeeks.com:2086
www.chickengeeks.com:2095
www.chickengeeks.com:443
www.chickengeeks.com:2053
www.chickengeeks.com:2083
www.chickengeeks.com:2087
www.chickengeeks.com:2096
www.chickengeeks.com:8443
klez.chickengeeks.com:80
klez.chickengeeks.com:22
klez.chickengeeks.com:8080
klez.chickengeeks.com:8880
klez.chickengeeks.com:2052
klez.chickengeeks.com:2082
klez.chickengeeks.com:2086
klez.chickengeeks.com:2095
klez.chickengeeks.com:443
klez.chickengeeks.com:2053
klez.chickengeeks.com:2083
klez.chickengeeks.com:2087
klez.chickengeeks.com:2096
klez.chickengeeks.com:8443
conficker.chickengeeks.com:80
conficker.chickengeeks.com:22
conficker.chickengeeks.com:8080
conficker.chickengeeks.com:8880
conficker.chickengeeks.com:2052
conficker.chickengeeks.com:2082
conficker.chickengeeks.com:2086
conficker.chickengeeks.com:2095
conficker.chickengeeks.com:443
conficker.chickengeeks.com:2053
conficker.chickengeeks.com:2083
conficker.chickengeeks.com:2087
conficker.chickengeeks.com:2096
conficker.chickengeeks.com:8443
malware.chickengeeks.com:80
malware.chickengeeks.com:22
malware.chickengeeks.com:8080
malware.chickengeeks.com:8880
malware.chickengeeks.com:2052
malware.chickengeeks.com:2082
malware.chickengeeks.com:2086
malware.chickengeeks.com:2095
malware.chickengeeks.com:443
malware.chickengeeks.com:2053
malware.chickengeeks.com:2083
malware.chickengeeks.com:2087
malware.chickengeeks.com:2096
malware.chickengeeks.com:8443

Mutex

LhoFhQYLjhnO

Attributes

delay
0
install
true
install_file
n22g.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  45d39718f956c7696f31986551fbd4cc83886eeab6b06a627c42f0acb938405a
- Size 45KB
- SHA256 45d39718f956c7696f31986551fbd4cc83886eeab6b06a627c42f0acb938405a
- MD5 ab33f7f43fd638e295c9b8c1d7a26019
- SHA1 e11033ce2f32b365a90eab6f7a5f23ee6709b7e2
- SHA512 1180f74c9d29dec216de35f66c7901820092e9261494dc904dd01a770b9ada7fc1b66ae62934ba14b4e0b226cbc5df19d76d13a3515b4654cd0547969f1acae7
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtDc30oiZPI/zjbggX3iKkx0sxKHy+pj9Jr+BE:MuBGJTPho2twR2iW/3bHXSKF1rpP8dEx
- TLSH
  T168232A003BE9C12BF2BE4F7498F26245867AF6633603D5491CC451DB5A13FC69A43AEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2