asyncrat | fa1b8c0b0470f487ea4fd44d66e124c6c6a80ba2b4143234f991d29fbcfa2f16

Sharing

Copy URL Twitter E-mail

General

Target
fa1b8c0b0470f487ea4fd44d66e124c6c6a80ba2b4143234f991d29fbcfa2f16.exe
Size 45KB
Sample260711-n1ppjsbt8y
SHA256 fa1b8c0b0470f487ea4fd44d66e124c6c6a80ba2b4143234f991d29fbcfa2f16
MD5 be80fc71b63303220fffa2b0ccb6f157
SHA1 e7c76dc87b7a5af0832e60cb812ca8967878bd1b
SHA512 59648f86dc921c3d6669ff1c1a7cc480fffc66c8c09aef0884e5c18a972f00c200018f499410776e939a24ca82942fa85bd6888ecc989f4346aaac0cec5d805b
SSDEEP 768:HuaXlpTtc3r9WUJ7q7mo2qr+fPLzizpvtLjZPI9zjbfgXIicGiaW0ptvfssnBDZj:Hua1pTtQS2pfHi1VjW93boXFcGGuxEWp
TLSH
T149232B003BE9812BF2BE4F78ADF25245867AF2632603D54D1CC451D75A13FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

innotech-development.com:80
innotech-development.com:22
innotech-development.com:8080
innotech-development.com:8880
innotech-development.com:2052
innotech-development.com:2082
innotech-development.com:2086
innotech-development.com:2095
innotech-development.com:443
innotech-development.com:2053
innotech-development.com:2083
innotech-development.com:2087
innotech-development.com:2096
innotech-development.com:8443
www.innotech-development.com:80
www.innotech-development.com:22
www.innotech-development.com:8080
www.innotech-development.com:8880
www.innotech-development.com:2052
www.innotech-development.com:2082
www.innotech-development.com:2086
www.innotech-development.com:2095
www.innotech-development.com:443
www.innotech-development.com:2053
www.innotech-development.com:2083
www.innotech-development.com:2087
www.innotech-development.com:2096
www.innotech-development.com:8443
notpetya.innotech-development.com:80
notpetya.innotech-development.com:22
notpetya.innotech-development.com:8080
notpetya.innotech-development.com:8880
notpetya.innotech-development.com:2052
notpetya.innotech-development.com:2082
notpetya.innotech-development.com:2086
notpetya.innotech-development.com:2095
notpetya.innotech-development.com:443
notpetya.innotech-development.com:2053
notpetya.innotech-development.com:2083
notpetya.innotech-development.com:2087
notpetya.innotech-development.com:2096
notpetya.innotech-development.com:8443
triton.innotech-development.com:80
triton.innotech-development.com:22
triton.innotech-development.com:8080
triton.innotech-development.com:8880
triton.innotech-development.com:2052
triton.innotech-development.com:2082
triton.innotech-development.com:2086
triton.innotech-development.com:2095
triton.innotech-development.com:443
triton.innotech-development.com:2053
triton.innotech-development.com:2083
triton.innotech-development.com:2087
triton.innotech-development.com:2096
triton.innotech-development.com:8443
locky.innotech-development.com:80
locky.innotech-development.com:22
locky.innotech-development.com:8080
locky.innotech-development.com:8880
locky.innotech-development.com:2052
locky.innotech-development.com:2082
locky.innotech-development.com:2086
locky.innotech-development.com:2095
locky.innotech-development.com:443
locky.innotech-development.com:2053
locky.innotech-development.com:2083
locky.innotech-development.com:2087
locky.innotech-development.com:2096
locky.innotech-development.com:8443
trickbot.innotech-development.com:80
trickbot.innotech-development.com:22
trickbot.innotech-development.com:8080
trickbot.innotech-development.com:8880
trickbot.innotech-development.com:2052
trickbot.innotech-development.com:2082
trickbot.innotech-development.com:2086
trickbot.innotech-development.com:2095
trickbot.innotech-development.com:443
trickbot.innotech-development.com:2053
trickbot.innotech-development.com:2083
trickbot.innotech-development.com:2087
trickbot.innotech-development.com:2096
trickbot.innotech-development.com:8443

Mutex

FBqhuVkBv4WW

Attributes

delay
0
install
true
install_file
ovyo.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  fa1b8c0b0470f487ea4fd44d66e124c6c6a80ba2b4143234f991d29fbcfa2f16.exe
- Size 45KB
- SHA256 fa1b8c0b0470f487ea4fd44d66e124c6c6a80ba2b4143234f991d29fbcfa2f16
- MD5 be80fc71b63303220fffa2b0ccb6f157
- SHA1 e7c76dc87b7a5af0832e60cb812ca8967878bd1b
- SHA512 59648f86dc921c3d6669ff1c1a7cc480fffc66c8c09aef0884e5c18a972f00c200018f499410776e939a24ca82942fa85bd6888ecc989f4346aaac0cec5d805b
- SSDEEP 768:HuaXlpTtc3r9WUJ7q7mo2qr+fPLzizpvtLjZPI9zjbfgXIicGiaW0ptvfssnBDZj:Hua1pTtQS2pfHi1VjW93boXFcGGuxEWp
- TLSH
  T149232B003BE9812BF2BE4F78ADF25245867AF2632603D54D1CC451D75A13FC69A42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2