asyncrat | 8b37b5884c24095e033c591cef5b944a6259f5d85cfa3012ed50b599f1c4e606

Sharing

Copy URL Twitter E-mail

General

Target
8b37b5884c24095e033c591cef5b944a6259f5d85cfa3012ed50b599f1c4e606
Size 45KB
Sample260706-epfg3adt7l
SHA256 8b37b5884c24095e033c591cef5b944a6259f5d85cfa3012ed50b599f1c4e606
MD5 4b5ce29b4e89d909e5cf2f603a50a78e
SHA1 444ad361c5bcfd133891b0d6331a2ec90888c08e
SHA512 c003a59fa866d8ef486bedce1e12f8ec427c7f96517a8423f421edfc8a28652ad74ed0a3d30f12f9ae4916fd324836592a919d85b1d01f0bb87f57fa6d8f6962
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98ITnyXaaPI9zjbZgX3iHY9u9bZ5tBDZsx:EufspTf2g23EZ93b2XSH9xdsx
TLSH
T186232B003BE9C12BF2BF4F78ADF26145467AF5632A03D5891CC4119B5713BC68A52AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexgaga.com:80
sexgaga.com:22
sexgaga.com:8080
sexgaga.com:8880
sexgaga.com:2052
sexgaga.com:2082
sexgaga.com:2086
sexgaga.com:2095
sexgaga.com:443
sexgaga.com:2053
sexgaga.com:2083
sexgaga.com:2087
sexgaga.com:2096
sexgaga.com:8443
www.sexgaga.com:80
www.sexgaga.com:22
www.sexgaga.com:8080
www.sexgaga.com:8880
www.sexgaga.com:2052
www.sexgaga.com:2082
www.sexgaga.com:2086
www.sexgaga.com:2095
www.sexgaga.com:443
www.sexgaga.com:2053
www.sexgaga.com:2083
www.sexgaga.com:2087
www.sexgaga.com:2096
www.sexgaga.com:8443
cl0p.sexgaga.com:80
cl0p.sexgaga.com:22
cl0p.sexgaga.com:8080
cl0p.sexgaga.com:8880
cl0p.sexgaga.com:2052
cl0p.sexgaga.com:2082
cl0p.sexgaga.com:2086
cl0p.sexgaga.com:2095
cl0p.sexgaga.com:443
cl0p.sexgaga.com:2053
cl0p.sexgaga.com:2083
cl0p.sexgaga.com:2087
cl0p.sexgaga.com:2096
cl0p.sexgaga.com:8443
shamoon.sexgaga.com:80
shamoon.sexgaga.com:22
shamoon.sexgaga.com:8080
shamoon.sexgaga.com:8880
shamoon.sexgaga.com:2052
shamoon.sexgaga.com:2082
shamoon.sexgaga.com:2086
shamoon.sexgaga.com:2095
shamoon.sexgaga.com:443
shamoon.sexgaga.com:2053
shamoon.sexgaga.com:2083
shamoon.sexgaga.com:2087
shamoon.sexgaga.com:2096
shamoon.sexgaga.com:8443
blaster.sexgaga.com:80
blaster.sexgaga.com:22
blaster.sexgaga.com:8080
blaster.sexgaga.com:8880
blaster.sexgaga.com:2052
blaster.sexgaga.com:2082
blaster.sexgaga.com:2086
blaster.sexgaga.com:2095
blaster.sexgaga.com:443
blaster.sexgaga.com:2053
blaster.sexgaga.com:2083
blaster.sexgaga.com:2087
blaster.sexgaga.com:2096
blaster.sexgaga.com:8443
triton.sexgaga.com:80
triton.sexgaga.com:22
triton.sexgaga.com:8080
triton.sexgaga.com:8880
triton.sexgaga.com:2052
triton.sexgaga.com:2082
triton.sexgaga.com:2086
triton.sexgaga.com:2095
triton.sexgaga.com:443
triton.sexgaga.com:2053
triton.sexgaga.com:2083
triton.sexgaga.com:2087
triton.sexgaga.com:2096
triton.sexgaga.com:8443

Mutex

JqfRFFvGCEug

Attributes

delay
0
install
true
install_file
2fhig34.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  8b37b5884c24095e033c591cef5b944a6259f5d85cfa3012ed50b599f1c4e606
- Size 45KB
- SHA256 8b37b5884c24095e033c591cef5b944a6259f5d85cfa3012ed50b599f1c4e606
- MD5 4b5ce29b4e89d909e5cf2f603a50a78e
- SHA1 444ad361c5bcfd133891b0d6331a2ec90888c08e
- SHA512 c003a59fa866d8ef486bedce1e12f8ec427c7f96517a8423f421edfc8a28652ad74ed0a3d30f12f9ae4916fd324836592a919d85b1d01f0bb87f57fa6d8f6962
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98ITnyXaaPI9zjbZgX3iHY9u9bZ5tBDZsx:EufspTf2g23EZ93b2XSH9xdsx
- TLSH
  T186232B003BE9C12BF2BF4F78ADF26145467AF5632A03D5891CC4119B5713BC68A52AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2