asyncrat | 9d6a83f4c58164e2865f959a634a618f88b5bda78e0424c48065123983cf405d

Sharing

Copy URL Twitter E-mail

General

Target
9d6a83f4c58164e2865f959a634a618f88b5bda78e0424c48065123983cf405d.exe
Size 45KB
Sample260703-mlbnpsfv3t
SHA256 9d6a83f4c58164e2865f959a634a618f88b5bda78e0424c48065123983cf405d
MD5 48dfd8fee4a9beefd0776bb8acd66b40
SHA1 22ab295c70470d23250d8fc5406d2593673f2ecd
SHA512 b91e7df21a0e5d30fcfac5df29d8626309d584794e18e80fd9910ed82f53cbe81f482d548c0925c0f76c837642afc259cbe051ecc6c1cf01fd6539bc77501aae
SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrYBz3QKx7PIUTjbGgX3iTcBGeA22X8XGhN3BDZkx:vuogpT7I627V0UXbZXSTpX8yNxdkx
TLSH
T113231A003BE9813BF2BE5BB8ACF25145867AF5632603D64D6CC412D75623FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

golicolombia.com:80
golicolombia.com:22
golicolombia.com:8080
golicolombia.com:8880
golicolombia.com:2052
golicolombia.com:2082
golicolombia.com:2086
golicolombia.com:2095
golicolombia.com:443
golicolombia.com:2053
golicolombia.com:2083
golicolombia.com:2087
golicolombia.com:2096
golicolombia.com:8443
www.golicolombia.com:80
www.golicolombia.com:22
www.golicolombia.com:8080
www.golicolombia.com:8880
www.golicolombia.com:2052
www.golicolombia.com:2082
www.golicolombia.com:2086
www.golicolombia.com:2095
www.golicolombia.com:443
www.golicolombia.com:2053
www.golicolombia.com:2083
www.golicolombia.com:2087
www.golicolombia.com:2096
www.golicolombia.com:8443
nanocore.golicolombia.com:80
nanocore.golicolombia.com:22
nanocore.golicolombia.com:8080
nanocore.golicolombia.com:8880
nanocore.golicolombia.com:2052
nanocore.golicolombia.com:2082
nanocore.golicolombia.com:2086
nanocore.golicolombia.com:2095
nanocore.golicolombia.com:443
nanocore.golicolombia.com:2053
nanocore.golicolombia.com:2083
nanocore.golicolombia.com:2087
nanocore.golicolombia.com:2096
nanocore.golicolombia.com:8443
hack.golicolombia.com:80
hack.golicolombia.com:22
hack.golicolombia.com:8080
hack.golicolombia.com:8880
hack.golicolombia.com:2052
hack.golicolombia.com:2082
hack.golicolombia.com:2086
hack.golicolombia.com:2095
hack.golicolombia.com:443
hack.golicolombia.com:2053
hack.golicolombia.com:2083
hack.golicolombia.com:2087
hack.golicolombia.com:2096
hack.golicolombia.com:8443
notpetya.golicolombia.com:80
notpetya.golicolombia.com:22
notpetya.golicolombia.com:8080
notpetya.golicolombia.com:8880
notpetya.golicolombia.com:2052
notpetya.golicolombia.com:2082
notpetya.golicolombia.com:2086
notpetya.golicolombia.com:2095
notpetya.golicolombia.com:443
notpetya.golicolombia.com:2053
notpetya.golicolombia.com:2083
notpetya.golicolombia.com:2087
notpetya.golicolombia.com:2096
notpetya.golicolombia.com:8443
ryuk.golicolombia.com:80
ryuk.golicolombia.com:22
ryuk.golicolombia.com:8080
ryuk.golicolombia.com:8880
ryuk.golicolombia.com:2052
ryuk.golicolombia.com:2082
ryuk.golicolombia.com:2086
ryuk.golicolombia.com:2095
ryuk.golicolombia.com:443
ryuk.golicolombia.com:2053
ryuk.golicolombia.com:2083
ryuk.golicolombia.com:2087
ryuk.golicolombia.com:2096
ryuk.golicolombia.com:8443

Mutex

abeZDgST24mv

Attributes

delay
0
install
true
install_file
ubf05vec.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  9d6a83f4c58164e2865f959a634a618f88b5bda78e0424c48065123983cf405d.exe
- Size 45KB
- SHA256 9d6a83f4c58164e2865f959a634a618f88b5bda78e0424c48065123983cf405d
- MD5 48dfd8fee4a9beefd0776bb8acd66b40
- SHA1 22ab295c70470d23250d8fc5406d2593673f2ecd
- SHA512 b91e7df21a0e5d30fcfac5df29d8626309d584794e18e80fd9910ed82f53cbe81f482d548c0925c0f76c837642afc259cbe051ecc6c1cf01fd6539bc77501aae
- SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrYBz3QKx7PIUTjbGgX3iTcBGeA22X8XGhN3BDZkx:vuogpT7I627V0UXbZXSTpX8yNxdkx
- TLSH
  T113231A003BE9813BF2BE5BB8ACF25145867AF5632603D64D6CC412D75623FC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2