asyncrat | 7c4ddfee0f10371fd6355c316fc8883d0306059651eb1a08e325c8f5aaa6d739

Sharing

Copy URL Twitter E-mail

General

Target
7c4ddfee0f10371fd6355c316fc8883d0306059651eb1a08e325c8f5aaa6d739
Size 45KB
Sample260711-ql6evsds8s
SHA256 7c4ddfee0f10371fd6355c316fc8883d0306059651eb1a08e325c8f5aaa6d739
MD5 39438728ddf01bb6a176141a3c987a13
SHA1 8ddc52550441867f45ba04ea17d8b32f7715143e
SHA512 8ddf1e01cb1c449dd3bea7bebcd0c9c0718cfe550ab28604425609992dda8803e257fe7d215937de8b4ef7839ba23efddb71571af23510bd058caffce11ef79a
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UITnyHaaPI8zjb0gX3i8bX+RoipBDZ0x:8uUIpT4vAj2wE583bbXS4+vd0x
TLSH
T17D231A0037E9C12BF2BE5F789DF26145867AB6633603D64A1CC411DB5723BC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s.damsex.blog:80
s.damsex.blog:22
s.damsex.blog:8080
s.damsex.blog:8880
s.damsex.blog:2052
s.damsex.blog:2082
s.damsex.blog:2086
s.damsex.blog:2095
s.damsex.blog:443
s.damsex.blog:2053
s.damsex.blog:2083
s.damsex.blog:2087
s.damsex.blog:2096
s.damsex.blog:8443
www.s.damsex.blog:80
www.s.damsex.blog:22
www.s.damsex.blog:8080
www.s.damsex.blog:8880
www.s.damsex.blog:2052
www.s.damsex.blog:2082
www.s.damsex.blog:2086
www.s.damsex.blog:2095
www.s.damsex.blog:443
www.s.damsex.blog:2053
www.s.damsex.blog:2083
www.s.damsex.blog:2087
www.s.damsex.blog:2096
www.s.damsex.blog:8443
klez.s.damsex.blog:80
klez.s.damsex.blog:22
klez.s.damsex.blog:8080
klez.s.damsex.blog:8880
klez.s.damsex.blog:2052
klez.s.damsex.blog:2082
klez.s.damsex.blog:2086
klez.s.damsex.blog:2095
klez.s.damsex.blog:443
klez.s.damsex.blog:2053
klez.s.damsex.blog:2083
klez.s.damsex.blog:2087
klez.s.damsex.blog:2096
klez.s.damsex.blog:8443
formbook.s.damsex.blog:80
formbook.s.damsex.blog:22
formbook.s.damsex.blog:8080
formbook.s.damsex.blog:8880
formbook.s.damsex.blog:2052
formbook.s.damsex.blog:2082
formbook.s.damsex.blog:2086
formbook.s.damsex.blog:2095
formbook.s.damsex.blog:443
formbook.s.damsex.blog:2053
formbook.s.damsex.blog:2083
formbook.s.damsex.blog:2087
formbook.s.damsex.blog:2096
formbook.s.damsex.blog:8443
clop.s.damsex.blog:80
clop.s.damsex.blog:22
clop.s.damsex.blog:8080
clop.s.damsex.blog:8880
clop.s.damsex.blog:2052
clop.s.damsex.blog:2082
clop.s.damsex.blog:2086
clop.s.damsex.blog:2095
clop.s.damsex.blog:443
clop.s.damsex.blog:2053
clop.s.damsex.blog:2083
clop.s.damsex.blog:2087
clop.s.damsex.blog:2096
clop.s.damsex.blog:8443
azorult.s.damsex.blog:80
azorult.s.damsex.blog:22
azorult.s.damsex.blog:8080
azorult.s.damsex.blog:8880
azorult.s.damsex.blog:2052
azorult.s.damsex.blog:2082
azorult.s.damsex.blog:2086
azorult.s.damsex.blog:2095
azorult.s.damsex.blog:443
azorult.s.damsex.blog:2053
azorult.s.damsex.blog:2083
azorult.s.damsex.blog:2087
azorult.s.damsex.blog:2096
azorult.s.damsex.blog:8443

Mutex

xkn0XWMaTN5T

Attributes

delay
0
install
true
install_file
nw340f2.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  7c4ddfee0f10371fd6355c316fc8883d0306059651eb1a08e325c8f5aaa6d739
- Size 45KB
- SHA256 7c4ddfee0f10371fd6355c316fc8883d0306059651eb1a08e325c8f5aaa6d739
- MD5 39438728ddf01bb6a176141a3c987a13
- SHA1 8ddc52550441867f45ba04ea17d8b32f7715143e
- SHA512 8ddf1e01cb1c449dd3bea7bebcd0c9c0718cfe550ab28604425609992dda8803e257fe7d215937de8b4ef7839ba23efddb71571af23510bd058caffce11ef79a
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UITnyHaaPI8zjb0gX3i8bX+RoipBDZ0x:8uUIpT4vAj2wE583bbXS4+vd0x
- TLSH
  T17D231A0037E9C12BF2BE5F789DF26145867AB6633603D64A1CC411DB5723BC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2