asyncrat | dafd72da4cbdf0e40c2d9c830ec7e4ae869e54662a760d0fc74c15da3efbeaf7

Sharing

Copy URL Twitter E-mail

General

Target
dafd72da4cbdf0e40c2d9c830ec7e4ae869e54662a760d0fc74c15da3efbeaf7
Size 45KB
Sample260711-f6gbcset7v
SHA256 dafd72da4cbdf0e40c2d9c830ec7e4ae869e54662a760d0fc74c15da3efbeaf7
MD5 36b27f3b420f5ce91d9a0b8571e00b8f
SHA1 7e19556172f1ea6a81eb2aa0668f0e1c98dde7e0
SHA512 ec8c46561a943df91f59c517eaf32eb900eb94478e98232e44eb98e5db19625b887247bd185f3362d0b4c9455997f00eb87379a9d42c7c23a445217791a35947
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFyls5ohEaMPISrjbAgX3iWsW9YoX2czp5BDZEx:MuLAZTnbg2X44EaxS/bnXSW9sctdEx
TLSH
T1FC231A003BE8822BF2BE4F789CF26145867AF2636603D55D2CC4519B5713FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

porn-th.com:80
porn-th.com:22
porn-th.com:8080
porn-th.com:8880
porn-th.com:2052
porn-th.com:2082
porn-th.com:2086
porn-th.com:2095
porn-th.com:443
porn-th.com:2053
porn-th.com:2083
porn-th.com:2087
porn-th.com:2096
porn-th.com:8443
www.porn-th.com:80
www.porn-th.com:22
www.porn-th.com:8080
www.porn-th.com:8880
www.porn-th.com:2052
www.porn-th.com:2082
www.porn-th.com:2086
www.porn-th.com:2095
www.porn-th.com:443
www.porn-th.com:2053
www.porn-th.com:2083
www.porn-th.com:2087
www.porn-th.com:2096
www.porn-th.com:8443
rat.porn-th.com:80
rat.porn-th.com:22
rat.porn-th.com:8080
rat.porn-th.com:8880
rat.porn-th.com:2052
rat.porn-th.com:2082
rat.porn-th.com:2086
rat.porn-th.com:2095
rat.porn-th.com:443
rat.porn-th.com:2053
rat.porn-th.com:2083
rat.porn-th.com:2087
rat.porn-th.com:2096
rat.porn-th.com:8443
blacklotus.porn-th.com:80
blacklotus.porn-th.com:22
blacklotus.porn-th.com:8080
blacklotus.porn-th.com:8880
blacklotus.porn-th.com:2052
blacklotus.porn-th.com:2082
blacklotus.porn-th.com:2086
blacklotus.porn-th.com:2095
blacklotus.porn-th.com:443
blacklotus.porn-th.com:2053
blacklotus.porn-th.com:2083
blacklotus.porn-th.com:2087
blacklotus.porn-th.com:2096
blacklotus.porn-th.com:8443
shamoon.porn-th.com:80
shamoon.porn-th.com:22
shamoon.porn-th.com:8080
shamoon.porn-th.com:8880
shamoon.porn-th.com:2052
shamoon.porn-th.com:2082
shamoon.porn-th.com:2086
shamoon.porn-th.com:2095
shamoon.porn-th.com:443
shamoon.porn-th.com:2053
shamoon.porn-th.com:2083
shamoon.porn-th.com:2087
shamoon.porn-th.com:2096
shamoon.porn-th.com:8443
lokibot.porn-th.com:80
lokibot.porn-th.com:22
lokibot.porn-th.com:8080
lokibot.porn-th.com:8880
lokibot.porn-th.com:2052
lokibot.porn-th.com:2082
lokibot.porn-th.com:2086
lokibot.porn-th.com:2095
lokibot.porn-th.com:443
lokibot.porn-th.com:2053
lokibot.porn-th.com:2083
lokibot.porn-th.com:2087
lokibot.porn-th.com:2096
lokibot.porn-th.com:8443

Mutex

8OvKhDY4Eu4H

Attributes

delay
0
install
true
install_file
u1cla.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  dafd72da4cbdf0e40c2d9c830ec7e4ae869e54662a760d0fc74c15da3efbeaf7
- Size 45KB
- SHA256 dafd72da4cbdf0e40c2d9c830ec7e4ae869e54662a760d0fc74c15da3efbeaf7
- MD5 36b27f3b420f5ce91d9a0b8571e00b8f
- SHA1 7e19556172f1ea6a81eb2aa0668f0e1c98dde7e0
- SHA512 ec8c46561a943df91f59c517eaf32eb900eb94478e98232e44eb98e5db19625b887247bd185f3362d0b4c9455997f00eb87379a9d42c7c23a445217791a35947
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFyls5ohEaMPISrjbAgX3iWsW9YoX2czp5BDZEx:MuLAZTnbg2X44EaxS/bnXSW9sctdEx
- TLSH
  T1FC231A003BE8822BF2BE4F789CF26145867AF2636603D55D2CC4519B5713FC69A42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2