asyncrat | 2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046

Sharing

Copy URL Twitter E-mail

General

Target
2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046
Size 45KB
Sample260706-fym4yah16w
SHA256 2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046
MD5 01d851c9865c1466620d614b23d89ec7
SHA1 e5f736ca4b55c3ba29c01e48cbc272d1d29d231f
SHA512 795e7fe5cc7bd5bc6d08bf5fb5b00ae6c5d08872c8a914aa6f006fa84513b11465a580cd6e385dc6212be9c65c4697655b543e8ae9e94de4775d8438af232de3
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAT0ewUkA1MiZPI7zjbag/3iK57TVwIyHPD5aBDZUx:cuqNJTLr62nwvDiW73bN/SK5PVwIyvDN
TLSH
T10E231B0037E8812BF2BE4F78A8F26245867AF6676A03D5491CC451DB5713FC6CA43AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

transferstropicalsunbay.com:80
transferstropicalsunbay.com:22
transferstropicalsunbay.com:8080
transferstropicalsunbay.com:8880
transferstropicalsunbay.com:2052
transferstropicalsunbay.com:2082
transferstropicalsunbay.com:2086
transferstropicalsunbay.com:2095
transferstropicalsunbay.com:443
transferstropicalsunbay.com:2053
transferstropicalsunbay.com:2083
transferstropicalsunbay.com:2087
transferstropicalsunbay.com:2096
transferstropicalsunbay.com:8443
www.transferstropicalsunbay.com:80
www.transferstropicalsunbay.com:22
www.transferstropicalsunbay.com:8080
www.transferstropicalsunbay.com:8880
www.transferstropicalsunbay.com:2052
www.transferstropicalsunbay.com:2082
www.transferstropicalsunbay.com:2086
www.transferstropicalsunbay.com:2095
www.transferstropicalsunbay.com:443
www.transferstropicalsunbay.com:2053
www.transferstropicalsunbay.com:2083
www.transferstropicalsunbay.com:2087
www.transferstropicalsunbay.com:2096
www.transferstropicalsunbay.com:8443
hack.transferstropicalsunbay.com:80
hack.transferstropicalsunbay.com:22
hack.transferstropicalsunbay.com:8080
hack.transferstropicalsunbay.com:8880
hack.transferstropicalsunbay.com:2052
hack.transferstropicalsunbay.com:2082
hack.transferstropicalsunbay.com:2086
hack.transferstropicalsunbay.com:2095
hack.transferstropicalsunbay.com:443
hack.transferstropicalsunbay.com:2053
hack.transferstropicalsunbay.com:2083
hack.transferstropicalsunbay.com:2087
hack.transferstropicalsunbay.com:2096
hack.transferstropicalsunbay.com:8443
shamoon.transferstropicalsunbay.com:80
shamoon.transferstropicalsunbay.com:22
shamoon.transferstropicalsunbay.com:8080
shamoon.transferstropicalsunbay.com:8880
shamoon.transferstropicalsunbay.com:2052
shamoon.transferstropicalsunbay.com:2082
shamoon.transferstropicalsunbay.com:2086
shamoon.transferstropicalsunbay.com:2095
shamoon.transferstropicalsunbay.com:443
shamoon.transferstropicalsunbay.com:2053
shamoon.transferstropicalsunbay.com:2083
shamoon.transferstropicalsunbay.com:2087
shamoon.transferstropicalsunbay.com:2096
shamoon.transferstropicalsunbay.com:8443

Mutex

zoD9o0DyhyEo

Attributes

delay
0
install
true
install_file
3yjh.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046
- Size 45KB
- SHA256 2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046
- MD5 01d851c9865c1466620d614b23d89ec7
- SHA1 e5f736ca4b55c3ba29c01e48cbc272d1d29d231f
- SHA512 795e7fe5cc7bd5bc6d08bf5fb5b00ae6c5d08872c8a914aa6f006fa84513b11465a580cd6e385dc6212be9c65c4697655b543e8ae9e94de4775d8438af232de3
- SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAT0ewUkA1MiZPI7zjbag/3iK57TVwIyHPD5aBDZUx:cuqNJTLr62nwvDiW73bN/SK5PVwIyvDN
- TLSH
  T10E231B0037E8812BF2BE4F78A8F26245867AF6676A03D5491CC451DB5713FC6CA43AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2