asyncrat | 9d28ac0e5124721b2b68db2376658fe0dd4086b45e062c69df796f60af804f45

Sharing

Copy URL Twitter E-mail

General

Target
9d28ac0e5124721b2b68db2376658fe0dd4086b45e062c69df796f60af804f45
Size 45KB
Sample260710-qvf7bsav3m
SHA256 9d28ac0e5124721b2b68db2376658fe0dd4086b45e062c69df796f60af804f45
MD5 022a6b8717e72dff3d5993bc896b1c10
SHA1 41a44b733000d947b1abcc9ebb2b759275b76004
SHA512 e46a013c97e7a5398398c92695bf5983666f365e4b7f738460853d066cd750ff7462afeee53245abc7675b22c12148d943988e64264ec9182f7b53e63ce2c4ea
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHBlte40WMOPI0IzjbYgXfi9oe5OGdwlyBDZEx:MuLAZTnbg202UM30I3bPXa9lXdEx
TLSH
T143232B003BE8812BF2BE4FB899F26145467EF6637603D68A1CC451D74613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

porn-th.com:80
porn-th.com:22
porn-th.com:8080
porn-th.com:8880
porn-th.com:2052
porn-th.com:2082
porn-th.com:2086
porn-th.com:2095
porn-th.com:443
porn-th.com:2053
porn-th.com:2083
porn-th.com:2087
porn-th.com:2096
porn-th.com:8443
www.porn-th.com:80
www.porn-th.com:22
www.porn-th.com:8080
www.porn-th.com:8880
www.porn-th.com:2052
www.porn-th.com:2082
www.porn-th.com:2086
www.porn-th.com:2095
www.porn-th.com:443
www.porn-th.com:2053
www.porn-th.com:2083
www.porn-th.com:2087
www.porn-th.com:2096
www.porn-th.com:8443
codered.porn-th.com:80
codered.porn-th.com:22
codered.porn-th.com:8080
codered.porn-th.com:8880
codered.porn-th.com:2052
codered.porn-th.com:2082
codered.porn-th.com:2086
codered.porn-th.com:2095
codered.porn-th.com:443
codered.porn-th.com:2053
codered.porn-th.com:2083
codered.porn-th.com:2087
codered.porn-th.com:2096
codered.porn-th.com:8443
locky.porn-th.com:80
locky.porn-th.com:22
locky.porn-th.com:8080
locky.porn-th.com:8880
locky.porn-th.com:2052
locky.porn-th.com:2082
locky.porn-th.com:2086
locky.porn-th.com:2095
locky.porn-th.com:443
locky.porn-th.com:2053
locky.porn-th.com:2083
locky.porn-th.com:2087
locky.porn-th.com:2096
locky.porn-th.com:8443
qakbot.porn-th.com:80
qakbot.porn-th.com:22
qakbot.porn-th.com:8080
qakbot.porn-th.com:8880
qakbot.porn-th.com:2052
qakbot.porn-th.com:2082
qakbot.porn-th.com:2086
qakbot.porn-th.com:2095
qakbot.porn-th.com:443
qakbot.porn-th.com:2053
qakbot.porn-th.com:2083
qakbot.porn-th.com:2087
qakbot.porn-th.com:2096
qakbot.porn-th.com:8443
cryptolocker.porn-th.com:80
cryptolocker.porn-th.com:22
cryptolocker.porn-th.com:8080
cryptolocker.porn-th.com:8880
cryptolocker.porn-th.com:2052
cryptolocker.porn-th.com:2082
cryptolocker.porn-th.com:2086
cryptolocker.porn-th.com:2095
cryptolocker.porn-th.com:443
cryptolocker.porn-th.com:2053
cryptolocker.porn-th.com:2083
cryptolocker.porn-th.com:2087
cryptolocker.porn-th.com:2096
cryptolocker.porn-th.com:8443

Mutex

rtTnZP2t1zOz

Attributes

delay
0
install
true
install_file
6p68p.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  9d28ac0e5124721b2b68db2376658fe0dd4086b45e062c69df796f60af804f45
- Size 45KB
- SHA256 9d28ac0e5124721b2b68db2376658fe0dd4086b45e062c69df796f60af804f45
- MD5 022a6b8717e72dff3d5993bc896b1c10
- SHA1 41a44b733000d947b1abcc9ebb2b759275b76004
- SHA512 e46a013c97e7a5398398c92695bf5983666f365e4b7f738460853d066cd750ff7462afeee53245abc7675b22c12148d943988e64264ec9182f7b53e63ce2c4ea
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHBlte40WMOPI0IzjbYgXfi9oe5OGdwlyBDZEx:MuLAZTnbg202UM30I3bPXa9lXdEx
- TLSH
  T143232B003BE8812BF2BE4FB899F26145467EF6637603D68A1CC451D74613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2