asyncrat | 86731b32ef220d0efffa7b089c9f43cda1d572b65649ded31c41572a49b827d7

Sharing

Copy URL Twitter E-mail

General

Target
86731b32ef220d0efffa7b089c9f43cda1d572b65649ded31c41572a49b827d7
Size 45KB
Sample260710-ntsgvsaw9m
SHA256 86731b32ef220d0efffa7b089c9f43cda1d572b65649ded31c41572a49b827d7
MD5 825e2fd5696ff431289d4714b98e9beb
SHA1 077936a58239435d3ec3627c8796a968409b2dfb
SHA512 41f5c0c65b6498f98974db78ea9a1241524b9fdfb17b168baac10de78a279c435741af405af9a68dbd47189484eaeb6d1fbd0d25dbd8ae9bc77cd424f3db1858
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94OJQ4CBQnSNjPIyzjbnOgX3UbY8arVgNB8l9BDZsx:EufspTf2g2ROJznSKy3bxXkbjarA8lTc
TLSH
T100231B003BD9812BF2BE4F7898F26145467AF6633603E54A2CC451DB5623FC6DA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

damsex.blog:80
damsex.blog:22
damsex.blog:8080
damsex.blog:8880
damsex.blog:2052
damsex.blog:2082
damsex.blog:2086
damsex.blog:2095
damsex.blog:443
damsex.blog:2053
damsex.blog:2083
damsex.blog:2087
damsex.blog:2096
damsex.blog:8443
www.damsex.blog:80
www.damsex.blog:22
www.damsex.blog:8080
www.damsex.blog:8880
www.damsex.blog:2052
www.damsex.blog:2082
www.damsex.blog:2086
www.damsex.blog:2095
www.damsex.blog:443
www.damsex.blog:2053
www.damsex.blog:2083
www.damsex.blog:2087
www.damsex.blog:2096
www.damsex.blog:8443
klez.damsex.blog:80
klez.damsex.blog:22
klez.damsex.blog:8080
klez.damsex.blog:8880
klez.damsex.blog:2052
klez.damsex.blog:2082
klez.damsex.blog:2086
klez.damsex.blog:2095
klez.damsex.blog:443
klez.damsex.blog:2053
klez.damsex.blog:2083
klez.damsex.blog:2087
klez.damsex.blog:2096
klez.damsex.blog:8443
rat.damsex.blog:80
rat.damsex.blog:22
rat.damsex.blog:8080
rat.damsex.blog:8880
rat.damsex.blog:2052
rat.damsex.blog:2082
rat.damsex.blog:2086
rat.damsex.blog:2095
rat.damsex.blog:443
rat.damsex.blog:2053
rat.damsex.blog:2083
rat.damsex.blog:2087
rat.damsex.blog:2096
rat.damsex.blog:8443
notpetya.damsex.blog:80
notpetya.damsex.blog:22
notpetya.damsex.blog:8080
notpetya.damsex.blog:8880
notpetya.damsex.blog:2052
notpetya.damsex.blog:2082
notpetya.damsex.blog:2086
notpetya.damsex.blog:2095
notpetya.damsex.blog:443
notpetya.damsex.blog:2053
notpetya.damsex.blog:2083
notpetya.damsex.blog:2087
notpetya.damsex.blog:2096
notpetya.damsex.blog:8443
melissa.damsex.blog:80
melissa.damsex.blog:22
melissa.damsex.blog:8080
melissa.damsex.blog:8880
melissa.damsex.blog:2052
melissa.damsex.blog:2082
melissa.damsex.blog:2086
melissa.damsex.blog:2095
melissa.damsex.blog:443
melissa.damsex.blog:2053
melissa.damsex.blog:2083
melissa.damsex.blog:2087
melissa.damsex.blog:2096
melissa.damsex.blog:8443

Mutex

1WGIIle77eP4

Attributes

delay
0
install
true
install_file
43dbojt.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  86731b32ef220d0efffa7b089c9f43cda1d572b65649ded31c41572a49b827d7
- Size 45KB
- SHA256 86731b32ef220d0efffa7b089c9f43cda1d572b65649ded31c41572a49b827d7
- MD5 825e2fd5696ff431289d4714b98e9beb
- SHA1 077936a58239435d3ec3627c8796a968409b2dfb
- SHA512 41f5c0c65b6498f98974db78ea9a1241524b9fdfb17b168baac10de78a279c435741af405af9a68dbd47189484eaeb6d1fbd0d25dbd8ae9bc77cd424f3db1858
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94OJQ4CBQnSNjPIyzjbnOgX3UbY8arVgNB8l9BDZsx:EufspTf2g2ROJznSKy3bxXkbjarA8lTc
- TLSH
  T100231B003BD9812BF2BE4F7898F26145467AF6633603E54A2CC451DB5623FC6DA426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2