asyncrat | fdb1215a9d4dc4feb2479b9220ca142f3f1f54fc21e91301b2466ffae935abb8

Sharing

Copy URL Twitter E-mail

General

Target
fdb1215a9d4dc4feb2479b9220ca142f3f1f54fc21e91301b2466ffae935abb8
Size 45KB
Sample260707-tkhh7ahs8s
SHA256 fdb1215a9d4dc4feb2479b9220ca142f3f1f54fc21e91301b2466ffae935abb8
MD5 b28993069b29b8dbf37e2a820bd4f1d2
SHA1 e72994d8132a06edfc758a78813b207ffafb6b4f
SHA512 e84e3f232d34f46b026ea6961880f2e919e3e21ed48a5649eff09bb975327206c092785854033f6780cc31e76e8175187688d896d6ff8f06e9bde37d18fa539e
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OFUwdrxIkDPIBzjbbgX3iHwk2J9JjCEkuQkm:MuBGJTPho2fqKTNMB3bkXSyTJjCEku1E
TLSH
T12123190037E9812BF1BE4F786DF26145867AF6637603D64A1CC401DB5A23FC58A52AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

ditnhauxx.com:80
ditnhauxx.com:22
ditnhauxx.com:8080
ditnhauxx.com:8880
ditnhauxx.com:2052
ditnhauxx.com:2082
ditnhauxx.com:2086
ditnhauxx.com:2095
ditnhauxx.com:443
ditnhauxx.com:2053
ditnhauxx.com:2083
ditnhauxx.com:2087
ditnhauxx.com:2096
ditnhauxx.com:8443
www.ditnhauxx.com:80
www.ditnhauxx.com:22
www.ditnhauxx.com:8080
www.ditnhauxx.com:8880
www.ditnhauxx.com:2052
www.ditnhauxx.com:2082
www.ditnhauxx.com:2086
www.ditnhauxx.com:2095
www.ditnhauxx.com:443
www.ditnhauxx.com:2053
www.ditnhauxx.com:2083
www.ditnhauxx.com:2087
www.ditnhauxx.com:2096
www.ditnhauxx.com:8443
connect.ditnhauxx.com:80
connect.ditnhauxx.com:22
connect.ditnhauxx.com:8080
connect.ditnhauxx.com:8880
connect.ditnhauxx.com:2052
connect.ditnhauxx.com:2082
connect.ditnhauxx.com:2086
connect.ditnhauxx.com:2095
connect.ditnhauxx.com:443
connect.ditnhauxx.com:2053
connect.ditnhauxx.com:2083
connect.ditnhauxx.com:2087
connect.ditnhauxx.com:2096
connect.ditnhauxx.com:8443
industroyer.ditnhauxx.com:80
industroyer.ditnhauxx.com:22
industroyer.ditnhauxx.com:8080
industroyer.ditnhauxx.com:8880
industroyer.ditnhauxx.com:2052
industroyer.ditnhauxx.com:2082
industroyer.ditnhauxx.com:2086
industroyer.ditnhauxx.com:2095
industroyer.ditnhauxx.com:443
industroyer.ditnhauxx.com:2053
industroyer.ditnhauxx.com:2083
industroyer.ditnhauxx.com:2087
industroyer.ditnhauxx.com:2096
industroyer.ditnhauxx.com:8443
nimda.ditnhauxx.com:80
nimda.ditnhauxx.com:22
nimda.ditnhauxx.com:8080
nimda.ditnhauxx.com:8880
nimda.ditnhauxx.com:2052
nimda.ditnhauxx.com:2082
nimda.ditnhauxx.com:2086
nimda.ditnhauxx.com:2095
nimda.ditnhauxx.com:443
nimda.ditnhauxx.com:2053
nimda.ditnhauxx.com:2083
nimda.ditnhauxx.com:2087
nimda.ditnhauxx.com:2096
nimda.ditnhauxx.com:8443

Mutex

czs99EjV7pG1

Attributes

delay
0
install
true
install_file
40y0.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  fdb1215a9d4dc4feb2479b9220ca142f3f1f54fc21e91301b2466ffae935abb8
- Size 45KB
- SHA256 fdb1215a9d4dc4feb2479b9220ca142f3f1f54fc21e91301b2466ffae935abb8
- MD5 b28993069b29b8dbf37e2a820bd4f1d2
- SHA1 e72994d8132a06edfc758a78813b207ffafb6b4f
- SHA512 e84e3f232d34f46b026ea6961880f2e919e3e21ed48a5649eff09bb975327206c092785854033f6780cc31e76e8175187688d896d6ff8f06e9bde37d18fa539e
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OFUwdrxIkDPIBzjbbgX3iHwk2J9JjCEkuQkm:MuBGJTPho2fqKTNMB3bkXSyTJjCEku1E
- TLSH
  T12123190037E9812BF1BE4F786DF26145867AF6637603D64A1CC401DB5A23FC58A52AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2