asyncrat | 1e19239e15ba34e61f20f3bbdda7fa70865880d3cb4298cc60ce8e430de9358a

Sharing

Copy URL Twitter E-mail

General

Target
1e19239e15ba34e61f20f3bbdda7fa70865880d3cb4298cc60ce8e430de9358a
Size 45KB
Sample260711-lc4gpafs3k
SHA256 1e19239e15ba34e61f20f3bbdda7fa70865880d3cb4298cc60ce8e430de9358a
MD5 83c2395cf71c84b73aa875569dad183b
SHA1 f3239d059e6e2de1b385771151f0a38ee9717079
SHA512 9f7e6c5e463100daad76167140be868eb7a62356dee60e98ec0a2b99de9907111f521ae7301f3932c7458bdf9eb6f674c14a6937ac3f0b081478498aa0195f13
SSDEEP 768:suJdpTP3tcsWUODmqmo2qVbxGQG9PHuPIczjbBgY3iYUMvYxGYztxtpBDZkx:suJdpTPdI2eHC3c3buYSAYxGktjdkx
TLSH
T1AF232A003BE8813BF2BE4F7898F26245467AF6637603D64D2CC451DB5623BC6DA426F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s.damsex.blog:80
s.damsex.blog:22
s.damsex.blog:8080
s.damsex.blog:8880
s.damsex.blog:2052
s.damsex.blog:2082
s.damsex.blog:2086
s.damsex.blog:2095
s.damsex.blog:443
s.damsex.blog:2053
s.damsex.blog:2083
s.damsex.blog:2087
s.damsex.blog:2096
s.damsex.blog:8443
www.s.damsex.blog:80
www.s.damsex.blog:22
www.s.damsex.blog:8080
www.s.damsex.blog:8880
www.s.damsex.blog:2052
www.s.damsex.blog:2082
www.s.damsex.blog:2086
www.s.damsex.blog:2095
www.s.damsex.blog:443
www.s.damsex.blog:2053
www.s.damsex.blog:2083
www.s.damsex.blog:2087
www.s.damsex.blog:2096
www.s.damsex.blog:8443
zbot.s.damsex.blog:80
zbot.s.damsex.blog:22
zbot.s.damsex.blog:8080
zbot.s.damsex.blog:8880
zbot.s.damsex.blog:2052
zbot.s.damsex.blog:2082
zbot.s.damsex.blog:2086
zbot.s.damsex.blog:2095
zbot.s.damsex.blog:443
zbot.s.damsex.blog:2053
zbot.s.damsex.blog:2083
zbot.s.damsex.blog:2087
zbot.s.damsex.blog:2096
zbot.s.damsex.blog:8443
wannacry.s.damsex.blog:80
wannacry.s.damsex.blog:22
wannacry.s.damsex.blog:8080
wannacry.s.damsex.blog:8880
wannacry.s.damsex.blog:2052
wannacry.s.damsex.blog:2082
wannacry.s.damsex.blog:2086
wannacry.s.damsex.blog:2095
wannacry.s.damsex.blog:443
wannacry.s.damsex.blog:2053
wannacry.s.damsex.blog:2083
wannacry.s.damsex.blog:2087
wannacry.s.damsex.blog:2096
wannacry.s.damsex.blog:8443
clop.s.damsex.blog:80
clop.s.damsex.blog:22
clop.s.damsex.blog:8080
clop.s.damsex.blog:8880
clop.s.damsex.blog:2052
clop.s.damsex.blog:2082
clop.s.damsex.blog:2086
clop.s.damsex.blog:2095
clop.s.damsex.blog:443
clop.s.damsex.blog:2053
clop.s.damsex.blog:2083
clop.s.damsex.blog:2087
clop.s.damsex.blog:2096
clop.s.damsex.blog:8443

Mutex

XB69DV315Bxa

Attributes

delay
0
install
true
install_file
cweosk8m.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1e19239e15ba34e61f20f3bbdda7fa70865880d3cb4298cc60ce8e430de9358a
- Size 45KB
- SHA256 1e19239e15ba34e61f20f3bbdda7fa70865880d3cb4298cc60ce8e430de9358a
- MD5 83c2395cf71c84b73aa875569dad183b
- SHA1 f3239d059e6e2de1b385771151f0a38ee9717079
- SHA512 9f7e6c5e463100daad76167140be868eb7a62356dee60e98ec0a2b99de9907111f521ae7301f3932c7458bdf9eb6f674c14a6937ac3f0b081478498aa0195f13
- SSDEEP 768:suJdpTP3tcsWUODmqmo2qVbxGQG9PHuPIczjbBgY3iYUMvYxGYztxtpBDZkx:suJdpTPdI2eHC3c3buYSAYxGktjdkx
- TLSH
  T1AF232A003BE8813BF2BE4F7898F26245467AF6637603D64D2CC451DB5623BC6DA426F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2