asyncrat | cbc0f9874def1613312d4855e922eefc69b5886c8ce2f447902215d17b53e8f2

Sharing

Copy URL Twitter E-mail

General

Target
cbc0f9874def1613312d4855e922eefc69b5886c8ce2f447902215d17b53e8f2
Size 45KB
Sample260710-m5f3jaa16v
SHA256 cbc0f9874def1613312d4855e922eefc69b5886c8ce2f447902215d17b53e8f2
MD5 27226dbe30e45fdf4b82551d3a6836b2
SHA1 03bc2c0a2c5e0a0b6bddbde274c187b4cb50b988
SHA512 2edb1d59701b94250089d97265e45013834e44918d1b122104e7bc194ff478ecf62313c110a782379996cb2abc21058da11b916aa0a58195524fd9c5f007dd58
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Jw0QUKXPIHzjbmgX3iYOfaHrNOOAMUWynBDZUx:cu6YepTPso22fH3b5XSYzLgOAVfdUx
TLSH
T191231B003BE9813BF2BE4FB898F26145867AF5632603D64D2CC451DB5623FC6DA426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

damsex.blog:80
damsex.blog:22
damsex.blog:8080
damsex.blog:8880
damsex.blog:2052
damsex.blog:2082
damsex.blog:2086
damsex.blog:2095
damsex.blog:443
damsex.blog:2053
damsex.blog:2083
damsex.blog:2087
damsex.blog:2096
damsex.blog:8443
www.damsex.blog:80
www.damsex.blog:22
www.damsex.blog:8080
www.damsex.blog:8880
www.damsex.blog:2052
www.damsex.blog:2082
www.damsex.blog:2086
www.damsex.blog:2095
www.damsex.blog:443
www.damsex.blog:2053
www.damsex.blog:2083
www.damsex.blog:2087
www.damsex.blog:2096
www.damsex.blog:8443
sasser.damsex.blog:80
sasser.damsex.blog:22
sasser.damsex.blog:8080
sasser.damsex.blog:8880
sasser.damsex.blog:2052
sasser.damsex.blog:2082
sasser.damsex.blog:2086
sasser.damsex.blog:2095
sasser.damsex.blog:443
sasser.damsex.blog:2053
sasser.damsex.blog:2083
sasser.damsex.blog:2087
sasser.damsex.blog:2096
sasser.damsex.blog:8443
cryptolocker.damsex.blog:80
cryptolocker.damsex.blog:22
cryptolocker.damsex.blog:8080
cryptolocker.damsex.blog:8880
cryptolocker.damsex.blog:2052
cryptolocker.damsex.blog:2082
cryptolocker.damsex.blog:2086
cryptolocker.damsex.blog:2095
cryptolocker.damsex.blog:443
cryptolocker.damsex.blog:2053
cryptolocker.damsex.blog:2083
cryptolocker.damsex.blog:2087
cryptolocker.damsex.blog:2096
cryptolocker.damsex.blog:8443
azorult.damsex.blog:80
azorult.damsex.blog:22
azorult.damsex.blog:8080
azorult.damsex.blog:8880
azorult.damsex.blog:2052
azorult.damsex.blog:2082
azorult.damsex.blog:2086
azorult.damsex.blog:2095
azorult.damsex.blog:443
azorult.damsex.blog:2053
azorult.damsex.blog:2083
azorult.damsex.blog:2087
azorult.damsex.blog:2096
azorult.damsex.blog:8443
trisis.damsex.blog:80
trisis.damsex.blog:22
trisis.damsex.blog:8080
trisis.damsex.blog:8880
trisis.damsex.blog:2052
trisis.damsex.blog:2082
trisis.damsex.blog:2086
trisis.damsex.blog:2095
trisis.damsex.blog:443
trisis.damsex.blog:2053
trisis.damsex.blog:2083
trisis.damsex.blog:2087
trisis.damsex.blog:2096
trisis.damsex.blog:8443

Mutex

BrDhpNNmYo6g

Attributes

delay
0
install
true
install_file
d1oo5554.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  cbc0f9874def1613312d4855e922eefc69b5886c8ce2f447902215d17b53e8f2
- Size 45KB
- SHA256 cbc0f9874def1613312d4855e922eefc69b5886c8ce2f447902215d17b53e8f2
- MD5 27226dbe30e45fdf4b82551d3a6836b2
- SHA1 03bc2c0a2c5e0a0b6bddbde274c187b4cb50b988
- SHA512 2edb1d59701b94250089d97265e45013834e44918d1b122104e7bc194ff478ecf62313c110a782379996cb2abc21058da11b916aa0a58195524fd9c5f007dd58
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Jw0QUKXPIHzjbmgX3iYOfaHrNOOAMUWynBDZUx:cu6YepTPso22fH3b5XSYzLgOAVfdUx
- TLSH
  T191231B003BE9813BF2BE4FB898F26145867AF5632603D64D2CC451DB5623FC6DA426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2