asyncrat | c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08

Sharing

Copy URL Twitter E-mail

General

Target
c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08
Size 45KB
Sample260710-ndj6jsbs5v
SHA256 c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08
MD5 4384f789b45f93d1a9c0da55d90eb7e6
SHA1 a50915482339136cab180d69028d2264f9a627df
SHA512 a451280973bdb1ff06a26105195974e8f950732e72fb36cc306ac164324c14c4e01a725af7bbd5ba5c7005027c6a7f462ec8e706e2271f2dff5ebb8a40e5fb4b
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFdm//GgrOPIm8zjbkgX3iGV1ltyHUuLN1jBDZEx:MuLAZTnbg2umHb3Z3brXS6N6lLvldEx
TLSH
T18B232B003BE8822BF2BE4F78ACF26145857AF2636603D54E1CC451D75A13FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

damsex.blog:80
damsex.blog:22
damsex.blog:8080
damsex.blog:8880
damsex.blog:2052
damsex.blog:2082
damsex.blog:2086
damsex.blog:2095
damsex.blog:443
damsex.blog:2053
damsex.blog:2083
damsex.blog:2087
damsex.blog:2096
damsex.blog:8443
www.damsex.blog:80
www.damsex.blog:22
www.damsex.blog:8080
www.damsex.blog:8880
www.damsex.blog:2052
www.damsex.blog:2082
www.damsex.blog:2086
www.damsex.blog:2095
www.damsex.blog:443
www.damsex.blog:2053
www.damsex.blog:2083
www.damsex.blog:2087
www.damsex.blog:2096
www.damsex.blog:8443
remote.damsex.blog:80
remote.damsex.blog:22
remote.damsex.blog:8080
remote.damsex.blog:8880
remote.damsex.blog:2052
remote.damsex.blog:2082
remote.damsex.blog:2086
remote.damsex.blog:2095
remote.damsex.blog:443
remote.damsex.blog:2053
remote.damsex.blog:2083
remote.damsex.blog:2087
remote.damsex.blog:2096
remote.damsex.blog:8443
ryuk.damsex.blog:80
ryuk.damsex.blog:22
ryuk.damsex.blog:8080
ryuk.damsex.blog:8880
ryuk.damsex.blog:2052
ryuk.damsex.blog:2082
ryuk.damsex.blog:2086
ryuk.damsex.blog:2095
ryuk.damsex.blog:443
ryuk.damsex.blog:2053
ryuk.damsex.blog:2083
ryuk.damsex.blog:2087
ryuk.damsex.blog:2096
ryuk.damsex.blog:8443
hacker.damsex.blog:80
hacker.damsex.blog:22
hacker.damsex.blog:8080
hacker.damsex.blog:8880
hacker.damsex.blog:2052
hacker.damsex.blog:2082
hacker.damsex.blog:2086
hacker.damsex.blog:2095
hacker.damsex.blog:443
hacker.damsex.blog:2053
hacker.damsex.blog:2083
hacker.damsex.blog:2087
hacker.damsex.blog:2096
hacker.damsex.blog:8443
iloveyou.damsex.blog:80
iloveyou.damsex.blog:22
iloveyou.damsex.blog:8080
iloveyou.damsex.blog:8880
iloveyou.damsex.blog:2052
iloveyou.damsex.blog:2082
iloveyou.damsex.blog:2086
iloveyou.damsex.blog:2095
iloveyou.damsex.blog:443
iloveyou.damsex.blog:2053
iloveyou.damsex.blog:2083
iloveyou.damsex.blog:2087
iloveyou.damsex.blog:2096
iloveyou.damsex.blog:8443

Mutex

ccfuftyJLPkl

Attributes

delay
0
install
true
install_file
92j9f.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08
- Size 45KB
- SHA256 c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08
- MD5 4384f789b45f93d1a9c0da55d90eb7e6
- SHA1 a50915482339136cab180d69028d2264f9a627df
- SHA512 a451280973bdb1ff06a26105195974e8f950732e72fb36cc306ac164324c14c4e01a725af7bbd5ba5c7005027c6a7f462ec8e706e2271f2dff5ebb8a40e5fb4b
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFdm//GgrOPIm8zjbkgX3iGV1ltyHUuLN1jBDZEx:MuLAZTnbg2umHb3Z3brXS6N6lLvldEx
- TLSH
  T18B232B003BE8822BF2BE4F78ACF26145857AF2636603D54E1CC451D75A13FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2