asyncrat | 0b142679b261c075b27ebcbe377ae51420e5819e014299e4f32e35647ad5facb

Sharing

Copy URL Twitter E-mail

General

Target
0b142679b261c075b27ebcbe377ae51420e5819e014299e4f32e35647ad5facb
Size 45KB
Sample260711-pr63xaax2k
SHA256 0b142679b261c075b27ebcbe377ae51420e5819e014299e4f32e35647ad5facb
MD5 2c00a7a0706d75d811d0c760cce4e864
SHA1 dcaf313b2f5626c45705c573ff68c2472729967f
SHA512 83ebd78ae39266fa65fc6d66e81014fd03ba6c62277368b1f263e1932fb640618aad1e7c8f382155c518021e4bffb150639c0a7483cfaa8358c68e8cbd7044e6
SSDEEP 768:HuUX/ZT5lVZjWUjziVmo2qz+SKFWKoobbb4vhM/nPIA9zjbsgX3imsEMOuWfbMN8:HuUPZT5ri2nSKdivh6AA93bjXSmYOGt2
TLSH
T100231B003BE8812BF2BF4FB869F261458A7AF2672603D54A1CC451D75613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

innotech-development.com:80
innotech-development.com:22
innotech-development.com:8080
innotech-development.com:8880
innotech-development.com:2052
innotech-development.com:2082
innotech-development.com:2086
innotech-development.com:2095
innotech-development.com:443
innotech-development.com:2053
innotech-development.com:2083
innotech-development.com:2087
innotech-development.com:2096
innotech-development.com:8443
www.innotech-development.com:80
www.innotech-development.com:22
www.innotech-development.com:8080
www.innotech-development.com:8880
www.innotech-development.com:2052
www.innotech-development.com:2082
www.innotech-development.com:2086
www.innotech-development.com:2095
www.innotech-development.com:443
www.innotech-development.com:2053
www.innotech-development.com:2083
www.innotech-development.com:2087
www.innotech-development.com:2096
www.innotech-development.com:8443
ryuk.innotech-development.com:80
ryuk.innotech-development.com:22
ryuk.innotech-development.com:8080
ryuk.innotech-development.com:8880
ryuk.innotech-development.com:2052
ryuk.innotech-development.com:2082
ryuk.innotech-development.com:2086
ryuk.innotech-development.com:2095
ryuk.innotech-development.com:443
ryuk.innotech-development.com:2053
ryuk.innotech-development.com:2083
ryuk.innotech-development.com:2087
ryuk.innotech-development.com:2096
ryuk.innotech-development.com:8443
nimda.innotech-development.com:80
nimda.innotech-development.com:22
nimda.innotech-development.com:8080
nimda.innotech-development.com:8880
nimda.innotech-development.com:2052
nimda.innotech-development.com:2082
nimda.innotech-development.com:2086
nimda.innotech-development.com:2095
nimda.innotech-development.com:443
nimda.innotech-development.com:2053
nimda.innotech-development.com:2083
nimda.innotech-development.com:2087
nimda.innotech-development.com:2096
nimda.innotech-development.com:8443
qakbot.innotech-development.com:80
qakbot.innotech-development.com:22
qakbot.innotech-development.com:8080
qakbot.innotech-development.com:8880
qakbot.innotech-development.com:2052
qakbot.innotech-development.com:2082
qakbot.innotech-development.com:2086
qakbot.innotech-development.com:2095
qakbot.innotech-development.com:443
qakbot.innotech-development.com:2053
qakbot.innotech-development.com:2083
qakbot.innotech-development.com:2087
qakbot.innotech-development.com:2096
qakbot.innotech-development.com:8443
hacker.innotech-development.com:80
hacker.innotech-development.com:22
hacker.innotech-development.com:8080
hacker.innotech-development.com:8880
hacker.innotech-development.com:2052
hacker.innotech-development.com:2082
hacker.innotech-development.com:2086
hacker.innotech-development.com:2095
hacker.innotech-development.com:443
hacker.innotech-development.com:2053
hacker.innotech-development.com:2083
hacker.innotech-development.com:2087
hacker.innotech-development.com:2096
hacker.innotech-development.com:8443

Mutex

nmguSDCuvAEC

Attributes

delay
0
install
true
install_file
myhqy.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  0b142679b261c075b27ebcbe377ae51420e5819e014299e4f32e35647ad5facb
- Size 45KB
- SHA256 0b142679b261c075b27ebcbe377ae51420e5819e014299e4f32e35647ad5facb
- MD5 2c00a7a0706d75d811d0c760cce4e864
- SHA1 dcaf313b2f5626c45705c573ff68c2472729967f
- SHA512 83ebd78ae39266fa65fc6d66e81014fd03ba6c62277368b1f263e1932fb640618aad1e7c8f382155c518021e4bffb150639c0a7483cfaa8358c68e8cbd7044e6
- SSDEEP 768:HuUX/ZT5lVZjWUjziVmo2qz+SKFWKoobbb4vhM/nPIA9zjbsgX3imsEMOuWfbMN8:HuUPZT5ri2nSKdivh6AA93bjXSmYOGt2
- TLSH
  T100231B003BE8812BF2BF4FB869F261458A7AF2672603D54A1CC451D75613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2