asyncrat | a1dce2f6c6158a296742c581dd3d547345eb53ba7f74324c2677214d0fcb7ad5

Sharing

Copy URL Twitter E-mail

General

Target
a1dce2f6c6158a296742c581dd3d547345eb53ba7f74324c2677214d0fcb7ad5
Size 45KB
Sample260710-r4b5eadw6v
SHA256 a1dce2f6c6158a296742c581dd3d547345eb53ba7f74324c2677214d0fcb7ad5
MD5 cec8dfb3ead7f314e8ffcbc0909dc627
SHA1 5a63568c6d8c06b8573f2a2ae7d0cd93f747d354
SHA512 457960c8e88a121fb8dbea77377340cd3a25a3754f5e3af72cd55af915ff28dc118d7b53804894a6ae9d632842bc71597e31909c758fee5305e571041e42c4b1
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT9Qpm9PImzjbUgX3iSuymrOVQ/cuH+BDZUx:cu6YepTPso2GQm3b7XSSuDSVwcQQdUx
TLSH
T1F3231B003BE88237F2BE4FB898F26145867AF6632603D54D2CC451DB5623FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

damsex.blog:80
damsex.blog:22
damsex.blog:8080
damsex.blog:8880
damsex.blog:2052
damsex.blog:2082
damsex.blog:2086
damsex.blog:2095
damsex.blog:443
damsex.blog:2053
damsex.blog:2083
damsex.blog:2087
damsex.blog:2096
damsex.blog:8443
www.damsex.blog:80
www.damsex.blog:22
www.damsex.blog:8080
www.damsex.blog:8880
www.damsex.blog:2052
www.damsex.blog:2082
www.damsex.blog:2086
www.damsex.blog:2095
www.damsex.blog:443
www.damsex.blog:2053
www.damsex.blog:2083
www.damsex.blog:2087
www.damsex.blog:2096
www.damsex.blog:8443
remote.damsex.blog:80
remote.damsex.blog:22
remote.damsex.blog:8080
remote.damsex.blog:8880
remote.damsex.blog:2052
remote.damsex.blog:2082
remote.damsex.blog:2086
remote.damsex.blog:2095
remote.damsex.blog:443
remote.damsex.blog:2053
remote.damsex.blog:2083
remote.damsex.blog:2087
remote.damsex.blog:2096
remote.damsex.blog:8443
stuxnet.damsex.blog:80
stuxnet.damsex.blog:22
stuxnet.damsex.blog:8080
stuxnet.damsex.blog:8880
stuxnet.damsex.blog:2052
stuxnet.damsex.blog:2082
stuxnet.damsex.blog:2086
stuxnet.damsex.blog:2095
stuxnet.damsex.blog:443
stuxnet.damsex.blog:2053
stuxnet.damsex.blog:2083
stuxnet.damsex.blog:2087
stuxnet.damsex.blog:2096
stuxnet.damsex.blog:8443
klez.damsex.blog:80
klez.damsex.blog:22
klez.damsex.blog:8080
klez.damsex.blog:8880
klez.damsex.blog:2052
klez.damsex.blog:2082
klez.damsex.blog:2086
klez.damsex.blog:2095
klez.damsex.blog:443
klez.damsex.blog:2053
klez.damsex.blog:2083
klez.damsex.blog:2087
klez.damsex.blog:2096
klez.damsex.blog:8443
gootloader.damsex.blog:80
gootloader.damsex.blog:22
gootloader.damsex.blog:8080
gootloader.damsex.blog:8880
gootloader.damsex.blog:2052
gootloader.damsex.blog:2082
gootloader.damsex.blog:2086
gootloader.damsex.blog:2095
gootloader.damsex.blog:443
gootloader.damsex.blog:2053
gootloader.damsex.blog:2083
gootloader.damsex.blog:2087
gootloader.damsex.blog:2096
gootloader.damsex.blog:8443

Mutex

mNfMsu4LgJY1

Attributes

delay
0
install
true
install_file
zhl0piq4.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a1dce2f6c6158a296742c581dd3d547345eb53ba7f74324c2677214d0fcb7ad5
- Size 45KB
- SHA256 a1dce2f6c6158a296742c581dd3d547345eb53ba7f74324c2677214d0fcb7ad5
- MD5 cec8dfb3ead7f314e8ffcbc0909dc627
- SHA1 5a63568c6d8c06b8573f2a2ae7d0cd93f747d354
- SHA512 457960c8e88a121fb8dbea77377340cd3a25a3754f5e3af72cd55af915ff28dc118d7b53804894a6ae9d632842bc71597e31909c758fee5305e571041e42c4b1
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT9Qpm9PImzjbUgX3iSuymrOVQ/cuH+BDZUx:cu6YepTPso2GQm3b7XSSuDSVwcQQdUx
- TLSH
  T1F3231B003BE88237F2BE4FB898F26145867AF6632603D54D2CC451DB5623FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2