asyncrat | 0eee4e7a772573ad4a49bd128c4469c7183bce9f35b72d3647b6a4e20a917569

Sharing

Copy URL Twitter E-mail

General

Target
0eee4e7a772573ad4a49bd128c4469c7183bce9f35b72d3647b6a4e20a917569
Size 45KB
Sample260707-mhh9dafy41
SHA256 0eee4e7a772573ad4a49bd128c4469c7183bce9f35b72d3647b6a4e20a917569
MD5 24fd137c139f4e44e95bd7be66294f2a
SHA1 b8e6cbb0c51ed2b8dcd2d602303ee0d6832eb024
SHA512 8f51152c0d45372757f55e688c7440bd739ba9566a1232de2b6c1322505059c4c04326ca5ded862b60ac44331eb7e374fb82419f0736ca299b4ad2d575d4179d
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwAl9fcBEahPItnjbsgX3i1s0PJirht49RueBDZMx:ku40ZTXEb2sLkEa+tjbjXSa0Jg49LdMx
TLSH
T12C233C003BE8822BF2BE4B7899F26105867EF6737603D54A2CC451DB5713BC696426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

ditnhauxx.com:80
ditnhauxx.com:22
ditnhauxx.com:8080
ditnhauxx.com:8880
ditnhauxx.com:2052
ditnhauxx.com:2082
ditnhauxx.com:2086
ditnhauxx.com:2095
ditnhauxx.com:443
ditnhauxx.com:2053
ditnhauxx.com:2083
ditnhauxx.com:2087
ditnhauxx.com:2096
ditnhauxx.com:8443
www.ditnhauxx.com:80
www.ditnhauxx.com:22
www.ditnhauxx.com:8080
www.ditnhauxx.com:8880
www.ditnhauxx.com:2052
www.ditnhauxx.com:2082
www.ditnhauxx.com:2086
www.ditnhauxx.com:2095
www.ditnhauxx.com:443
www.ditnhauxx.com:2053
www.ditnhauxx.com:2083
www.ditnhauxx.com:2087
www.ditnhauxx.com:2096
www.ditnhauxx.com:8443
sobig.ditnhauxx.com:80
sobig.ditnhauxx.com:22
sobig.ditnhauxx.com:8080
sobig.ditnhauxx.com:8880
sobig.ditnhauxx.com:2052
sobig.ditnhauxx.com:2082
sobig.ditnhauxx.com:2086
sobig.ditnhauxx.com:2095
sobig.ditnhauxx.com:443
sobig.ditnhauxx.com:2053
sobig.ditnhauxx.com:2083
sobig.ditnhauxx.com:2087
sobig.ditnhauxx.com:2096
sobig.ditnhauxx.com:8443
darkside.ditnhauxx.com:80
darkside.ditnhauxx.com:22
darkside.ditnhauxx.com:8080
darkside.ditnhauxx.com:8880
darkside.ditnhauxx.com:2052
darkside.ditnhauxx.com:2082
darkside.ditnhauxx.com:2086
darkside.ditnhauxx.com:2095
darkside.ditnhauxx.com:443
darkside.ditnhauxx.com:2053
darkside.ditnhauxx.com:2083
darkside.ditnhauxx.com:2087
darkside.ditnhauxx.com:2096
darkside.ditnhauxx.com:8443
sodinokibi.ditnhauxx.com:80
sodinokibi.ditnhauxx.com:22
sodinokibi.ditnhauxx.com:8080
sodinokibi.ditnhauxx.com:8880
sodinokibi.ditnhauxx.com:2052
sodinokibi.ditnhauxx.com:2082
sodinokibi.ditnhauxx.com:2086
sodinokibi.ditnhauxx.com:2095
sodinokibi.ditnhauxx.com:443
sodinokibi.ditnhauxx.com:2053
sodinokibi.ditnhauxx.com:2083
sodinokibi.ditnhauxx.com:2087
sodinokibi.ditnhauxx.com:2096
sodinokibi.ditnhauxx.com:8443
melissa.ditnhauxx.com:80
melissa.ditnhauxx.com:22
melissa.ditnhauxx.com:8080
melissa.ditnhauxx.com:8880
melissa.ditnhauxx.com:2052
melissa.ditnhauxx.com:2082
melissa.ditnhauxx.com:2086
melissa.ditnhauxx.com:2095
melissa.ditnhauxx.com:443
melissa.ditnhauxx.com:2053
melissa.ditnhauxx.com:2083
melissa.ditnhauxx.com:2087
melissa.ditnhauxx.com:2096
melissa.ditnhauxx.com:8443

Mutex

r7DA6AcC9o1U

Attributes

delay
0
install
true
install_file
86jxd.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  0eee4e7a772573ad4a49bd128c4469c7183bce9f35b72d3647b6a4e20a917569
- Size 45KB
- SHA256 0eee4e7a772573ad4a49bd128c4469c7183bce9f35b72d3647b6a4e20a917569
- MD5 24fd137c139f4e44e95bd7be66294f2a
- SHA1 b8e6cbb0c51ed2b8dcd2d602303ee0d6832eb024
- SHA512 8f51152c0d45372757f55e688c7440bd739ba9566a1232de2b6c1322505059c4c04326ca5ded862b60ac44331eb7e374fb82419f0736ca299b4ad2d575d4179d
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwAl9fcBEahPItnjbsgX3i1s0PJirht49RueBDZMx:ku40ZTXEb2sLkEa+tjbjXSa0Jg49LdMx
- TLSH
  T12C233C003BE8822BF2BE4B7899F26105867EF6737603D54A2CC451DB5713BC696426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2