asyncrat | 9f72a2b6009752aedda8dfc89e62b45aa340c1fed7dddf3dd283f90d59774135

Sharing

Copy URL Twitter E-mail

General

Target
9f72a2b6009752aedda8dfc89e62b45aa340c1fed7dddf3dd283f90d59774135
Size 45KB
Sample260707-vtm1psa19n
SHA256 9f72a2b6009752aedda8dfc89e62b45aa340c1fed7dddf3dd283f90d59774135
MD5 68ea59c6f0e74e79a2fa047f5906241b
SHA1 f7f0b57b4a8e0cc3152cb48421ed2485acfb6581
SHA512 145ed3ce8e70b661a462bd267cd5d50bf48bba4c3b40ac5246e55fa810ef2ed82368204659ac711660a75491bcef010c00dd0e1d678b61924ddf2d15576eab8a
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9yS70ynzuOPIOzjbVgX4iTYJFcW49BDZ8x:0uPrpT/qY2fSwh3O3byXVUgW4Td8x
TLSH
T1D7233B0037E8812BF2BE4F789DF26145867AF5637603D54A1CC451DB5623FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

northspecialty.com:80
northspecialty.com:22
northspecialty.com:8080
northspecialty.com:8880
northspecialty.com:2052
northspecialty.com:2082
northspecialty.com:2086
northspecialty.com:2095
northspecialty.com:443
northspecialty.com:2053
northspecialty.com:2083
northspecialty.com:2087
northspecialty.com:2096
northspecialty.com:8443
www.northspecialty.com:80
www.northspecialty.com:22
www.northspecialty.com:8080
www.northspecialty.com:8880
www.northspecialty.com:2052
www.northspecialty.com:2082
www.northspecialty.com:2086
www.northspecialty.com:2095
www.northspecialty.com:443
www.northspecialty.com:2053
www.northspecialty.com:2083
www.northspecialty.com:2087
www.northspecialty.com:2096
www.northspecialty.com:8443
client.northspecialty.com:80
client.northspecialty.com:22
client.northspecialty.com:8080
client.northspecialty.com:8880
client.northspecialty.com:2052
client.northspecialty.com:2082
client.northspecialty.com:2086
client.northspecialty.com:2095
client.northspecialty.com:443
client.northspecialty.com:2053
client.northspecialty.com:2083
client.northspecialty.com:2087
client.northspecialty.com:2096
client.northspecialty.com:8443
sobig.northspecialty.com:80
sobig.northspecialty.com:22
sobig.northspecialty.com:8080
sobig.northspecialty.com:8880
sobig.northspecialty.com:2052
sobig.northspecialty.com:2082
sobig.northspecialty.com:2086
sobig.northspecialty.com:2095
sobig.northspecialty.com:443
sobig.northspecialty.com:2053
sobig.northspecialty.com:2083
sobig.northspecialty.com:2087
sobig.northspecialty.com:2096
sobig.northspecialty.com:8443

Mutex

ILuG3xx1stJW

Attributes

delay
0
install
true
install_file
cug3wzn.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  9f72a2b6009752aedda8dfc89e62b45aa340c1fed7dddf3dd283f90d59774135
- Size 45KB
- SHA256 9f72a2b6009752aedda8dfc89e62b45aa340c1fed7dddf3dd283f90d59774135
- MD5 68ea59c6f0e74e79a2fa047f5906241b
- SHA1 f7f0b57b4a8e0cc3152cb48421ed2485acfb6581
- SHA512 145ed3ce8e70b661a462bd267cd5d50bf48bba4c3b40ac5246e55fa810ef2ed82368204659ac711660a75491bcef010c00dd0e1d678b61924ddf2d15576eab8a
- SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9yS70ynzuOPIOzjbVgX4iTYJFcW49BDZ8x:0uPrpT/qY2fSwh3O3byXVUgW4Td8x
- TLSH
  T1D7233B0037E8812BF2BE4F789DF26145867AF5637603D54A1CC451DB5623FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2