asyncrat | 65a4aa5e068c896eb561c1fb4036bc0081cbe9e51feb67003c9e672e4cf45b3a

Sharing

Copy URL Twitter E-mail

General

Target
65a4aa5e068c896eb561c1fb4036bc0081cbe9e51feb67003c9e672e4cf45b3a
Size 45KB
Sample260707-qzse6abs2y
SHA256 65a4aa5e068c896eb561c1fb4036bc0081cbe9e51feb67003c9e672e4cf45b3a
MD5 613d71caa0eafb5d8dfe525dd9d6c6e5
SHA1 3a0b872795f47efb999c7131b115b6ffa2d1b677
SHA512 988d3078e32d1f69ce4cbd157c3532a46af46944820f758adf088bd4d5be82cdc842210f915e184d446c752994821d819098fc193c418fa4ccd8e0bafa431028
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXKGoibbb6tN8/nPI6DzjbBgX3iNkfKGTIlqSB8:ku40ZTXEb2TeDqtNKA6D3buXSNM4lvdO
TLSH
T1CB2319003BE8822BF2BE4B7899F26145867AF2737603D95A1CC4519B5623FC58A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

ditnhauxx.com:80
ditnhauxx.com:22
ditnhauxx.com:8080
ditnhauxx.com:8880
ditnhauxx.com:2052
ditnhauxx.com:2082
ditnhauxx.com:2086
ditnhauxx.com:2095
ditnhauxx.com:443
ditnhauxx.com:2053
ditnhauxx.com:2083
ditnhauxx.com:2087
ditnhauxx.com:2096
ditnhauxx.com:8443
www.ditnhauxx.com:80
www.ditnhauxx.com:22
www.ditnhauxx.com:8080
www.ditnhauxx.com:8880
www.ditnhauxx.com:2052
www.ditnhauxx.com:2082
www.ditnhauxx.com:2086
www.ditnhauxx.com:2095
www.ditnhauxx.com:443
www.ditnhauxx.com:2053
www.ditnhauxx.com:2083
www.ditnhauxx.com:2087
www.ditnhauxx.com:2096
www.ditnhauxx.com:8443
darkside.ditnhauxx.com:80
darkside.ditnhauxx.com:22
darkside.ditnhauxx.com:8080
darkside.ditnhauxx.com:8880
darkside.ditnhauxx.com:2052
darkside.ditnhauxx.com:2082
darkside.ditnhauxx.com:2086
darkside.ditnhauxx.com:2095
darkside.ditnhauxx.com:443
darkside.ditnhauxx.com:2053
darkside.ditnhauxx.com:2083
darkside.ditnhauxx.com:2087
darkside.ditnhauxx.com:2096
darkside.ditnhauxx.com:8443
notpetya.ditnhauxx.com:80
notpetya.ditnhauxx.com:22
notpetya.ditnhauxx.com:8080
notpetya.ditnhauxx.com:8880
notpetya.ditnhauxx.com:2052
notpetya.ditnhauxx.com:2082
notpetya.ditnhauxx.com:2086
notpetya.ditnhauxx.com:2095
notpetya.ditnhauxx.com:443
notpetya.ditnhauxx.com:2053
notpetya.ditnhauxx.com:2083
notpetya.ditnhauxx.com:2087
notpetya.ditnhauxx.com:2096
notpetya.ditnhauxx.com:8443
client.ditnhauxx.com:80
client.ditnhauxx.com:22
client.ditnhauxx.com:8080
client.ditnhauxx.com:8880
client.ditnhauxx.com:2052
client.ditnhauxx.com:2082
client.ditnhauxx.com:2086
client.ditnhauxx.com:2095
client.ditnhauxx.com:443
client.ditnhauxx.com:2053
client.ditnhauxx.com:2083
client.ditnhauxx.com:2087
client.ditnhauxx.com:2096
client.ditnhauxx.com:8443
clop.ditnhauxx.com:80
clop.ditnhauxx.com:22
clop.ditnhauxx.com:8080
clop.ditnhauxx.com:8880
clop.ditnhauxx.com:2052
clop.ditnhauxx.com:2082
clop.ditnhauxx.com:2086
clop.ditnhauxx.com:2095
clop.ditnhauxx.com:443
clop.ditnhauxx.com:2053
clop.ditnhauxx.com:2083
clop.ditnhauxx.com:2087
clop.ditnhauxx.com:2096
clop.ditnhauxx.com:8443

Mutex

TbmaTSNe5Dwr

Attributes

delay
0
install
true
install_file
yzb0x.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  65a4aa5e068c896eb561c1fb4036bc0081cbe9e51feb67003c9e672e4cf45b3a
- Size 45KB
- SHA256 65a4aa5e068c896eb561c1fb4036bc0081cbe9e51feb67003c9e672e4cf45b3a
- MD5 613d71caa0eafb5d8dfe525dd9d6c6e5
- SHA1 3a0b872795f47efb999c7131b115b6ffa2d1b677
- SHA512 988d3078e32d1f69ce4cbd157c3532a46af46944820f758adf088bd4d5be82cdc842210f915e184d446c752994821d819098fc193c418fa4ccd8e0bafa431028
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXKGoibbb6tN8/nPI6DzjbBgX3iNkfKGTIlqSB8:ku40ZTXEb2TeDqtNKA6D3buXSNM4lvdO
- TLSH
  T1CB2319003BE8822BF2BE4B7899F26145867AF2737603D95A1CC4519B5623FC58A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2