asyncrat | a31c5a84dcb30ede539a76866ccb429e167822ce2436cb0e4ac5404d95a87dae

Sharing

Copy URL Twitter E-mail

General

Target
a31c5a84dcb30ede539a76866ccb429e167822ce2436cb0e4ac5404d95a87dae
Size 45KB
Sample260711-s8shmaet3k
SHA256 a31c5a84dcb30ede539a76866ccb429e167822ce2436cb0e4ac5404d95a87dae
MD5 a9e33302e399f30e6652758d9613d49a
SHA1 98f233484038357388c298f479045ce07ef640f6
SHA512 5ff71361195bcb4e9503792ba362eb64cf11593df290cb4e973379957e67b66ae4cd6b00312015ba7996ce802f3bdf025ef2f356e487426d9d112432b569b71c
SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qre8V1RpPEcPIMzjbOgX3i/VueJR+KvBDZ0x:ruKQpTAOX2z8VDZEhM3bxXS/VuXKZd0x
TLSH
T1B3233C003BE9823BF2BE5F7899F26145867AF6632603E54E1CC441DB5613FC68642AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

innotech-development.com:80
innotech-development.com:22
innotech-development.com:8080
innotech-development.com:8880
innotech-development.com:2052
innotech-development.com:2082
innotech-development.com:2086
innotech-development.com:2095
innotech-development.com:443
innotech-development.com:2053
innotech-development.com:2083
innotech-development.com:2087
innotech-development.com:2096
innotech-development.com:8443
www.innotech-development.com:80
www.innotech-development.com:22
www.innotech-development.com:8080
www.innotech-development.com:8880
www.innotech-development.com:2052
www.innotech-development.com:2082
www.innotech-development.com:2086
www.innotech-development.com:2095
www.innotech-development.com:443
www.innotech-development.com:2053
www.innotech-development.com:2083
www.innotech-development.com:2087
www.innotech-development.com:2096
www.innotech-development.com:8443
zbot.innotech-development.com:80
zbot.innotech-development.com:22
zbot.innotech-development.com:8080
zbot.innotech-development.com:8880
zbot.innotech-development.com:2052
zbot.innotech-development.com:2082
zbot.innotech-development.com:2086
zbot.innotech-development.com:2095
zbot.innotech-development.com:443
zbot.innotech-development.com:2053
zbot.innotech-development.com:2083
zbot.innotech-development.com:2087
zbot.innotech-development.com:2096
zbot.innotech-development.com:8443
sobig.innotech-development.com:80
sobig.innotech-development.com:22
sobig.innotech-development.com:8080
sobig.innotech-development.com:8880
sobig.innotech-development.com:2052
sobig.innotech-development.com:2082
sobig.innotech-development.com:2086
sobig.innotech-development.com:2095
sobig.innotech-development.com:443
sobig.innotech-development.com:2053
sobig.innotech-development.com:2083
sobig.innotech-development.com:2087
sobig.innotech-development.com:2096
sobig.innotech-development.com:8443
socgholish.innotech-development.com:80
socgholish.innotech-development.com:22
socgholish.innotech-development.com:8080
socgholish.innotech-development.com:8880
socgholish.innotech-development.com:2052
socgholish.innotech-development.com:2082
socgholish.innotech-development.com:2086
socgholish.innotech-development.com:2095
socgholish.innotech-development.com:443
socgholish.innotech-development.com:2053
socgholish.innotech-development.com:2083
socgholish.innotech-development.com:2087
socgholish.innotech-development.com:2096
socgholish.innotech-development.com:8443

Mutex

XuIcu4j88LS3

Attributes

delay
0
install
true
install_file
9plu.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a31c5a84dcb30ede539a76866ccb429e167822ce2436cb0e4ac5404d95a87dae
- Size 45KB
- SHA256 a31c5a84dcb30ede539a76866ccb429e167822ce2436cb0e4ac5404d95a87dae
- MD5 a9e33302e399f30e6652758d9613d49a
- SHA1 98f233484038357388c298f479045ce07ef640f6
- SHA512 5ff71361195bcb4e9503792ba362eb64cf11593df290cb4e973379957e67b66ae4cd6b00312015ba7996ce802f3bdf025ef2f356e487426d9d112432b569b71c
- SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qre8V1RpPEcPIMzjbOgX3i/VueJR+KvBDZ0x:ruKQpTAOX2z8VDZEhM3bxXS/VuXKZd0x
- TLSH
  T1B3233C003BE9823BF2BE5F7899F26145867AF6632603E54E1CC441DB5613FC68642AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2