asyncrat | e0f7b16099dcaa244e34f11539f03ed17525e618529f981b42ab7a4946805917

Sharing

Copy URL Twitter E-mail

General

Target
e0f7b16099dcaa244e34f11539f03ed17525e618529f981b42ab7a4946805917
Size 45KB
Sample260710-r593tsdw9s
SHA256 e0f7b16099dcaa244e34f11539f03ed17525e618529f981b42ab7a4946805917
MD5 79e126ad0a16e6188e7c69ccc49cfa16
SHA1 b555963ab7ec0c512a247873ab557b14f6a3779d
SHA512 4b2f3f8a5b161ba05a8e528462e5e2a8dc81607a291d6c602f148a5de3df6774b86becf198d75b93dc5411d11a6f303ea8ab774e17e066afd6919417efe12726
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVh0e3NEAKViZPIazjbXg63inFTSp6tpKN1BDZEx:MuBGJTPho2E3exiWa3bw6SnFTY60bdEx
TLSH
T1D9231A0037E8C12BF2BE4F74A8F26145867AF6672603D54A1CC451DB5A23FC6DA43AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

damsex.blog:80
damsex.blog:22
damsex.blog:8080
damsex.blog:8880
damsex.blog:2052
damsex.blog:2082
damsex.blog:2086
damsex.blog:2095
damsex.blog:443
damsex.blog:2053
damsex.blog:2083
damsex.blog:2087
damsex.blog:2096
damsex.blog:8443
www.damsex.blog:80
www.damsex.blog:22
www.damsex.blog:8080
www.damsex.blog:8880
www.damsex.blog:2052
www.damsex.blog:2082
www.damsex.blog:2086
www.damsex.blog:2095
www.damsex.blog:443
www.damsex.blog:2053
www.damsex.blog:2083
www.damsex.blog:2087
www.damsex.blog:2096
www.damsex.blog:8443
qakbot.damsex.blog:80
qakbot.damsex.blog:22
qakbot.damsex.blog:8080
qakbot.damsex.blog:8880
qakbot.damsex.blog:2052
qakbot.damsex.blog:2082
qakbot.damsex.blog:2086
qakbot.damsex.blog:2095
qakbot.damsex.blog:443
qakbot.damsex.blog:2053
qakbot.damsex.blog:2083
qakbot.damsex.blog:2087
qakbot.damsex.blog:2096
qakbot.damsex.blog:8443
iloveyou.damsex.blog:80
iloveyou.damsex.blog:22
iloveyou.damsex.blog:8080
iloveyou.damsex.blog:8880
iloveyou.damsex.blog:2052
iloveyou.damsex.blog:2082
iloveyou.damsex.blog:2086
iloveyou.damsex.blog:2095
iloveyou.damsex.blog:443
iloveyou.damsex.blog:2053
iloveyou.damsex.blog:2083
iloveyou.damsex.blog:2087
iloveyou.damsex.blog:2096
iloveyou.damsex.blog:8443
revil.damsex.blog:80
revil.damsex.blog:22
revil.damsex.blog:8080
revil.damsex.blog:8880
revil.damsex.blog:2052
revil.damsex.blog:2082
revil.damsex.blog:2086
revil.damsex.blog:2095
revil.damsex.blog:443
revil.damsex.blog:2053
revil.damsex.blog:2083
revil.damsex.blog:2087
revil.damsex.blog:2096
revil.damsex.blog:8443
invasive.damsex.blog:80
invasive.damsex.blog:22
invasive.damsex.blog:8080
invasive.damsex.blog:8880
invasive.damsex.blog:2052
invasive.damsex.blog:2082
invasive.damsex.blog:2086
invasive.damsex.blog:2095
invasive.damsex.blog:443
invasive.damsex.blog:2053
invasive.damsex.blog:2083
invasive.damsex.blog:2087
invasive.damsex.blog:2096
invasive.damsex.blog:8443

Mutex

AG7D4eEbH77o

Attributes

delay
0
install
true
install_file
kk6k.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  e0f7b16099dcaa244e34f11539f03ed17525e618529f981b42ab7a4946805917
- Size 45KB
- SHA256 e0f7b16099dcaa244e34f11539f03ed17525e618529f981b42ab7a4946805917
- MD5 79e126ad0a16e6188e7c69ccc49cfa16
- SHA1 b555963ab7ec0c512a247873ab557b14f6a3779d
- SHA512 4b2f3f8a5b161ba05a8e528462e5e2a8dc81607a291d6c602f148a5de3df6774b86becf198d75b93dc5411d11a6f303ea8ab774e17e066afd6919417efe12726
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVh0e3NEAKViZPIazjbXg63inFTSp6tpKN1BDZEx:MuBGJTPho2E3exiWa3bw6SnFTY60bdEx
- TLSH
  T1D9231A0037E8C12BF2BE4F74A8F26145867AF6672603D54A1CC451DB5A23FC6DA43AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2