asyncrat | cbd26e6c0e1626bd74b2b06c3fe10902ae84d64d809e984726b96d5ad2214c91

Sharing

Copy URL Twitter E-mail

General

Target
cbd26e6c0e1626bd74b2b06c3fe10902ae84d64d809e984726b96d5ad2214c91
Size 45KB
Sample260710-m552naa17v
SHA256 cbd26e6c0e1626bd74b2b06c3fe10902ae84d64d809e984726b96d5ad2214c91
MD5 1287e603f545009026eda83a889cb7e5
SHA1 7b922707db33cd88d480c7ff321cbd088765884f
SHA512 31d69f226a3acc179c1188c61ea839a343bc0daceec434b869805b5c08c29056f6a2da4bdbc3d98fe8646af60bf1dd8b95458c8a1304ccd09eb5028459815f8c
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVh0e3NEAKViZPIazjbbgy3i6hzOPUWwGZUBDZEx:MuBGJTPho2E3exiWa3bkyS2C1wGYdEx
TLSH
T182231A0037E9812BF1BE4F78A9F26245867AF6733603D5491CC451DB4A13FC69A436EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

porn-th.com:80
porn-th.com:22
porn-th.com:8080
porn-th.com:8880
porn-th.com:2052
porn-th.com:2082
porn-th.com:2086
porn-th.com:2095
porn-th.com:443
porn-th.com:2053
porn-th.com:2083
porn-th.com:2087
porn-th.com:2096
porn-th.com:8443
www.porn-th.com:80
www.porn-th.com:22
www.porn-th.com:8080
www.porn-th.com:8880
www.porn-th.com:2052
www.porn-th.com:2082
www.porn-th.com:2086
www.porn-th.com:2095
www.porn-th.com:443
www.porn-th.com:2053
www.porn-th.com:2083
www.porn-th.com:2087
www.porn-th.com:2096
www.porn-th.com:8443
azorult.porn-th.com:80
azorult.porn-th.com:22
azorult.porn-th.com:8080
azorult.porn-th.com:8880
azorult.porn-th.com:2052
azorult.porn-th.com:2082
azorult.porn-th.com:2086
azorult.porn-th.com:2095
azorult.porn-th.com:443
azorult.porn-th.com:2053
azorult.porn-th.com:2083
azorult.porn-th.com:2087
azorult.porn-th.com:2096
azorult.porn-th.com:8443
zeus.porn-th.com:80
zeus.porn-th.com:22
zeus.porn-th.com:8080
zeus.porn-th.com:8880
zeus.porn-th.com:2052
zeus.porn-th.com:2082
zeus.porn-th.com:2086
zeus.porn-th.com:2095
zeus.porn-th.com:443
zeus.porn-th.com:2053
zeus.porn-th.com:2083
zeus.porn-th.com:2087
zeus.porn-th.com:2096
zeus.porn-th.com:8443
nanocore.porn-th.com:80
nanocore.porn-th.com:22
nanocore.porn-th.com:8080
nanocore.porn-th.com:8880
nanocore.porn-th.com:2052
nanocore.porn-th.com:2082
nanocore.porn-th.com:2086
nanocore.porn-th.com:2095
nanocore.porn-th.com:443
nanocore.porn-th.com:2053
nanocore.porn-th.com:2083
nanocore.porn-th.com:2087
nanocore.porn-th.com:2096
nanocore.porn-th.com:8443
dridex.porn-th.com:80
dridex.porn-th.com:22
dridex.porn-th.com:8080
dridex.porn-th.com:8880
dridex.porn-th.com:2052
dridex.porn-th.com:2082
dridex.porn-th.com:2086
dridex.porn-th.com:2095
dridex.porn-th.com:443
dridex.porn-th.com:2053
dridex.porn-th.com:2083
dridex.porn-th.com:2087
dridex.porn-th.com:2096
dridex.porn-th.com:8443

Mutex

n3nKnyhZkf8y

Attributes

delay
0
install
true
install_file
zlqj.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  cbd26e6c0e1626bd74b2b06c3fe10902ae84d64d809e984726b96d5ad2214c91
- Size 45KB
- SHA256 cbd26e6c0e1626bd74b2b06c3fe10902ae84d64d809e984726b96d5ad2214c91
- MD5 1287e603f545009026eda83a889cb7e5
- SHA1 7b922707db33cd88d480c7ff321cbd088765884f
- SHA512 31d69f226a3acc179c1188c61ea839a343bc0daceec434b869805b5c08c29056f6a2da4bdbc3d98fe8646af60bf1dd8b95458c8a1304ccd09eb5028459815f8c
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVh0e3NEAKViZPIazjbbgy3i6hzOPUWwGZUBDZEx:MuBGJTPho2E3exiWa3bkyS2C1wGYdEx
- TLSH
  T182231A0037E9812BF1BE4F78A9F26245867AF6733603D5491CC451DB4A13FC69A436EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2