asyncrat | 9b4027572d106ed67b2a7f64191a46c7859e4fca0c41e4b48a0b828691a650c5

Sharing

Copy URL Twitter E-mail

General

Target
9b4027572d106ed67b2a7f64191a46c7859e4fca0c41e4b48a0b828691a650c5
Size 45KB
Sample260703-nexs2af15t
SHA256 9b4027572d106ed67b2a7f64191a46c7859e4fca0c41e4b48a0b828691a650c5
MD5 ab2410d9babf8de60d2b9d06145a76c2
SHA1 a76c4d441dcfcfaad821c2989964012231915123
SHA512 12a44f520377708c63414ee3ad399137eb96cb77850eaefca3aec36452699c0cfccff44abcf8748402178827d2c2ba08baa817fe1661ebab112caa3c82851625
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OUUwdrxIkDPI/zjbqgX3irSQDhPFhBenoBDw:MuBGJTPho2fqPTNM/3b9XSrSwqOdEx
TLSH
T18B231A0037E8812BF2BE4F7468F26245867AF6737603D64D1CC441DB5623FC69A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

myzoomboom.com:80
myzoomboom.com:22
myzoomboom.com:8080
myzoomboom.com:8880
myzoomboom.com:2052
myzoomboom.com:2082
myzoomboom.com:2086
myzoomboom.com:2095
myzoomboom.com:443
myzoomboom.com:2053
myzoomboom.com:2083
myzoomboom.com:2087
myzoomboom.com:2096
myzoomboom.com:8443
www.myzoomboom.com:80
www.myzoomboom.com:22
www.myzoomboom.com:8080
www.myzoomboom.com:8880
www.myzoomboom.com:2052
www.myzoomboom.com:2082
www.myzoomboom.com:2086
www.myzoomboom.com:2095
www.myzoomboom.com:443
www.myzoomboom.com:2053
www.myzoomboom.com:2083
www.myzoomboom.com:2087
www.myzoomboom.com:2096
www.myzoomboom.com:8443
invasive.myzoomboom.com:80
invasive.myzoomboom.com:22
invasive.myzoomboom.com:8080
invasive.myzoomboom.com:8880
invasive.myzoomboom.com:2052
invasive.myzoomboom.com:2082
invasive.myzoomboom.com:2086
invasive.myzoomboom.com:2095
invasive.myzoomboom.com:443
invasive.myzoomboom.com:2053
invasive.myzoomboom.com:2083
invasive.myzoomboom.com:2087
invasive.myzoomboom.com:2096
invasive.myzoomboom.com:8443
gh0st.myzoomboom.com:80
gh0st.myzoomboom.com:22
gh0st.myzoomboom.com:8080
gh0st.myzoomboom.com:8880
gh0st.myzoomboom.com:2052
gh0st.myzoomboom.com:2082
gh0st.myzoomboom.com:2086
gh0st.myzoomboom.com:2095
gh0st.myzoomboom.com:443
gh0st.myzoomboom.com:2053
gh0st.myzoomboom.com:2083
gh0st.myzoomboom.com:2087
gh0st.myzoomboom.com:2096
gh0st.myzoomboom.com:8443
blaster.myzoomboom.com:80
blaster.myzoomboom.com:22
blaster.myzoomboom.com:8080
blaster.myzoomboom.com:8880
blaster.myzoomboom.com:2052
blaster.myzoomboom.com:2082
blaster.myzoomboom.com:2086
blaster.myzoomboom.com:2095
blaster.myzoomboom.com:443
blaster.myzoomboom.com:2053
blaster.myzoomboom.com:2083
blaster.myzoomboom.com:2087
blaster.myzoomboom.com:2096
blaster.myzoomboom.com:8443

Mutex

rvXCYxU4t8GX

Attributes

delay
0
install
true
install_file
yk20.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  9b4027572d106ed67b2a7f64191a46c7859e4fca0c41e4b48a0b828691a650c5
- Size 45KB
- SHA256 9b4027572d106ed67b2a7f64191a46c7859e4fca0c41e4b48a0b828691a650c5
- MD5 ab2410d9babf8de60d2b9d06145a76c2
- SHA1 a76c4d441dcfcfaad821c2989964012231915123
- SHA512 12a44f520377708c63414ee3ad399137eb96cb77850eaefca3aec36452699c0cfccff44abcf8748402178827d2c2ba08baa817fe1661ebab112caa3c82851625
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OUUwdrxIkDPI/zjbqgX3irSQDhPFhBenoBDw:MuBGJTPho2fqPTNM/3b9XSrSwqOdEx
- TLSH
  T18B231A0037E8812BF2BE4F7468F26245867AF6737603D64D1CC441DB5623FC69A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2