asyncrat | f954f9d47ab004c2322f98cf8e61775b623c3767721bf324419db3c1b25b2c42

Sharing

Copy URL Twitter E-mail

General

Target
f954f9d47ab004c2322f98cf8e61775b623c3767721bf324419db3c1b25b2c42.exe
Size 45KB
Sample260710-hegh6afz2w
SHA256 f954f9d47ab004c2322f98cf8e61775b623c3767721bf324419db3c1b25b2c42
MD5 b07795e5d0f5becb640ba766ab4ae97d
SHA1 ece0901f2256f8683fb624fc2d2d2d01df58e030
SHA512 549a0e57c787e26a494221eb8ddb9526d4b5d321f505693938f9c3a6b09b218190d3f78e5d4d5cecb41cbfc9d075dbd9d635c3ac85cfa335e2f8d057819a1e1e
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1emaPol53APIkzjbYgX3imaaIuLstD4M1BDZUx:cu6YepTPso2vfob3lk3bPXS2dLxsdUx
TLSH
T134231B003BE98127F2BF4F7899F26145867AF6637603DA8E1CC451DB0713FC69A426E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

getinspiredbycathy.com:80
getinspiredbycathy.com:22
getinspiredbycathy.com:8080
getinspiredbycathy.com:8880
getinspiredbycathy.com:2052
getinspiredbycathy.com:2082
getinspiredbycathy.com:2086
getinspiredbycathy.com:2095
getinspiredbycathy.com:443
getinspiredbycathy.com:2053
getinspiredbycathy.com:2083
getinspiredbycathy.com:2087
getinspiredbycathy.com:2096
getinspiredbycathy.com:8443
www.getinspiredbycathy.com:80
www.getinspiredbycathy.com:22
www.getinspiredbycathy.com:8080
www.getinspiredbycathy.com:8880
www.getinspiredbycathy.com:2052
www.getinspiredbycathy.com:2082
www.getinspiredbycathy.com:2086
www.getinspiredbycathy.com:2095
www.getinspiredbycathy.com:443
www.getinspiredbycathy.com:2053
www.getinspiredbycathy.com:2083
www.getinspiredbycathy.com:2087
www.getinspiredbycathy.com:2096
www.getinspiredbycathy.com:8443
mydoom.getinspiredbycathy.com:80
mydoom.getinspiredbycathy.com:22
mydoom.getinspiredbycathy.com:8080
mydoom.getinspiredbycathy.com:8880
mydoom.getinspiredbycathy.com:2052
mydoom.getinspiredbycathy.com:2082
mydoom.getinspiredbycathy.com:2086
mydoom.getinspiredbycathy.com:2095
mydoom.getinspiredbycathy.com:443
mydoom.getinspiredbycathy.com:2053
mydoom.getinspiredbycathy.com:2083
mydoom.getinspiredbycathy.com:2087
mydoom.getinspiredbycathy.com:2096
mydoom.getinspiredbycathy.com:8443
iloveyou.getinspiredbycathy.com:80
iloveyou.getinspiredbycathy.com:22
iloveyou.getinspiredbycathy.com:8080
iloveyou.getinspiredbycathy.com:8880
iloveyou.getinspiredbycathy.com:2052
iloveyou.getinspiredbycathy.com:2082
iloveyou.getinspiredbycathy.com:2086
iloveyou.getinspiredbycathy.com:2095
iloveyou.getinspiredbycathy.com:443
iloveyou.getinspiredbycathy.com:2053
iloveyou.getinspiredbycathy.com:2083
iloveyou.getinspiredbycathy.com:2087
iloveyou.getinspiredbycathy.com:2096
iloveyou.getinspiredbycathy.com:8443

Mutex

dgg6AHTA4uGb

Attributes

delay
0
install
true
install_file
cspjuezx.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  f954f9d47ab004c2322f98cf8e61775b623c3767721bf324419db3c1b25b2c42.exe
- Size 45KB
- SHA256 f954f9d47ab004c2322f98cf8e61775b623c3767721bf324419db3c1b25b2c42
- MD5 b07795e5d0f5becb640ba766ab4ae97d
- SHA1 ece0901f2256f8683fb624fc2d2d2d01df58e030
- SHA512 549a0e57c787e26a494221eb8ddb9526d4b5d321f505693938f9c3a6b09b218190d3f78e5d4d5cecb41cbfc9d075dbd9d635c3ac85cfa335e2f8d057819a1e1e
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1emaPol53APIkzjbYgX3imaaIuLstD4M1BDZUx:cu6YepTPso2vfob3lk3bPXS2dLxsdUx
- TLSH
  T134231B003BE98127F2BF4F7899F26145867AF6637603DA8E1CC451DB0713FC69A426E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2