asyncrat | a466cea27b9d840454383ce5926dc59665aae72a8a2a0eef0413f6241c1155f5

Sharing

Copy URL Twitter E-mail

General

Target
a466cea27b9d840454383ce5926dc59665aae72a8a2a0eef0413f6241c1155f5
Size 45KB
Sample260711-jfss9ady8k
SHA256 a466cea27b9d840454383ce5926dc59665aae72a8a2a0eef0413f6241c1155f5
MD5 2454924e896b5f3da71a80f512d3fcb2
SHA1 1d0955d195430f03596443b2ba40021187426754
SHA512 3d7d177eddb5a9b2a10a9069ff9effaff4f0abf214ad8b4161ecce310b6410b609eae683be29ea06e00306f3b0ab1cbbf185227260b76a3e6164fc7cd440c0b9
SSDEEP 768:Iu6RaepTPYzbs8WU+Xaamo2q1m0UwPOlehAPITpzjb7gX3iBizCLyywNcyn3BDZa:Iu6YepTPso2/0/OghlTp3bEXSRmyweyq
TLSH
T1D3232A003BE8813BF2BE5F7899F26105867AF6637603D5491CC451DB4A23FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s.damsex.blog:80
s.damsex.blog:22
s.damsex.blog:8080
s.damsex.blog:8880
s.damsex.blog:2052
s.damsex.blog:2082
s.damsex.blog:2086
s.damsex.blog:2095
s.damsex.blog:443
s.damsex.blog:2053
s.damsex.blog:2083
s.damsex.blog:2087
s.damsex.blog:2096
s.damsex.blog:8443
www.s.damsex.blog:80
www.s.damsex.blog:22
www.s.damsex.blog:8080
www.s.damsex.blog:8880
www.s.damsex.blog:2052
www.s.damsex.blog:2082
www.s.damsex.blog:2086
www.s.damsex.blog:2095
www.s.damsex.blog:443
www.s.damsex.blog:2053
www.s.damsex.blog:2083
www.s.damsex.blog:2087
www.s.damsex.blog:2096
www.s.damsex.blog:8443
blacklotus.s.damsex.blog:80
blacklotus.s.damsex.blog:22
blacklotus.s.damsex.blog:8080
blacklotus.s.damsex.blog:8880
blacklotus.s.damsex.blog:2052
blacklotus.s.damsex.blog:2082
blacklotus.s.damsex.blog:2086
blacklotus.s.damsex.blog:2095
blacklotus.s.damsex.blog:443
blacklotus.s.damsex.blog:2053
blacklotus.s.damsex.blog:2083
blacklotus.s.damsex.blog:2087
blacklotus.s.damsex.blog:2096
blacklotus.s.damsex.blog:8443
ursnif.s.damsex.blog:80
ursnif.s.damsex.blog:22
ursnif.s.damsex.blog:8080
ursnif.s.damsex.blog:8880
ursnif.s.damsex.blog:2052
ursnif.s.damsex.blog:2082
ursnif.s.damsex.blog:2086
ursnif.s.damsex.blog:2095
ursnif.s.damsex.blog:443
ursnif.s.damsex.blog:2053
ursnif.s.damsex.blog:2083
ursnif.s.damsex.blog:2087
ursnif.s.damsex.blog:2096
ursnif.s.damsex.blog:8443
sodinokibi.s.damsex.blog:80
sodinokibi.s.damsex.blog:22
sodinokibi.s.damsex.blog:8080
sodinokibi.s.damsex.blog:8880
sodinokibi.s.damsex.blog:2052
sodinokibi.s.damsex.blog:2082
sodinokibi.s.damsex.blog:2086
sodinokibi.s.damsex.blog:2095
sodinokibi.s.damsex.blog:443
sodinokibi.s.damsex.blog:2053
sodinokibi.s.damsex.blog:2083
sodinokibi.s.damsex.blog:2087
sodinokibi.s.damsex.blog:2096
sodinokibi.s.damsex.blog:8443

Mutex

kvuwfIJbdmiP

Attributes

delay
0
install
true
install_file
mg6zjgpv.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a466cea27b9d840454383ce5926dc59665aae72a8a2a0eef0413f6241c1155f5
- Size 45KB
- SHA256 a466cea27b9d840454383ce5926dc59665aae72a8a2a0eef0413f6241c1155f5
- MD5 2454924e896b5f3da71a80f512d3fcb2
- SHA1 1d0955d195430f03596443b2ba40021187426754
- SHA512 3d7d177eddb5a9b2a10a9069ff9effaff4f0abf214ad8b4161ecce310b6410b609eae683be29ea06e00306f3b0ab1cbbf185227260b76a3e6164fc7cd440c0b9
- SSDEEP 768:Iu6RaepTPYzbs8WU+Xaamo2q1m0UwPOlehAPITpzjb7gX3iBizCLyywNcyn3BDZa:Iu6YepTPso2/0/OghlTp3bEXSRmyweyq
- TLSH
  T1D3232A003BE8813BF2BE5F7899F26105867AF6637603D5491CC451DB4A23FC69A42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2