asyncrat | 91c66a734756f4b5c7e1c033e20fd9d90b3ab6d80c02d2394c299981f962d6ed

Sharing

Copy URL Twitter E-mail

General

Target
91c66a734756f4b5c7e1c033e20fd9d90b3ab6d80c02d2394c299981f962d6ed
Size 45KB
Sample260711-t5wljsfs7n
SHA256 91c66a734756f4b5c7e1c033e20fd9d90b3ab6d80c02d2394c299981f962d6ed
MD5 4a8291a7a9fd520850d7852aaa75efbe
SHA1 397f4ae7033bdcfae9c2fac198cff657a20e57da
SHA512 a35fb7f597eaa2755702ccafe1d587ff527903f56b6a391c15d5ed8d270ef1f66b24dd08e6d101357b070feb3f374954c6d373c3cb19994cc60f9082a39160ff
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMSPI5rjbegX3i3wvjitao/SQ9MmBDZsx:EulCJTHl42agG5/bhXS3wvjOaoKQZdsx
TLSH
T1EB23290037E8C12BE2BE5F78A9F26145867AF6637603D64D2CC4419B1723FC59A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s.damsex.blog:80
s.damsex.blog:22
s.damsex.blog:8080
s.damsex.blog:8880
s.damsex.blog:2052
s.damsex.blog:2082
s.damsex.blog:2086
s.damsex.blog:2095
s.damsex.blog:443
s.damsex.blog:2053
s.damsex.blog:2083
s.damsex.blog:2087
s.damsex.blog:2096
s.damsex.blog:8443
www.s.damsex.blog:80
www.s.damsex.blog:22
www.s.damsex.blog:8080
www.s.damsex.blog:8880
www.s.damsex.blog:2052
www.s.damsex.blog:2082
www.s.damsex.blog:2086
www.s.damsex.blog:2095
www.s.damsex.blog:443
www.s.damsex.blog:2053
www.s.damsex.blog:2083
www.s.damsex.blog:2087
www.s.damsex.blog:2096
www.s.damsex.blog:8443
hermeticwiper.s.damsex.blog:80
hermeticwiper.s.damsex.blog:22
hermeticwiper.s.damsex.blog:8080
hermeticwiper.s.damsex.blog:8880
hermeticwiper.s.damsex.blog:2052
hermeticwiper.s.damsex.blog:2082
hermeticwiper.s.damsex.blog:2086
hermeticwiper.s.damsex.blog:2095
hermeticwiper.s.damsex.blog:443
hermeticwiper.s.damsex.blog:2053
hermeticwiper.s.damsex.blog:2083
hermeticwiper.s.damsex.blog:2087
hermeticwiper.s.damsex.blog:2096
hermeticwiper.s.damsex.blog:8443
darkside.s.damsex.blog:80
darkside.s.damsex.blog:22
darkside.s.damsex.blog:8080
darkside.s.damsex.blog:8880
darkside.s.damsex.blog:2052
darkside.s.damsex.blog:2082
darkside.s.damsex.blog:2086
darkside.s.damsex.blog:2095
darkside.s.damsex.blog:443
darkside.s.damsex.blog:2053
darkside.s.damsex.blog:2083
darkside.s.damsex.blog:2087
darkside.s.damsex.blog:2096
darkside.s.damsex.blog:8443
conti.s.damsex.blog:80
conti.s.damsex.blog:22
conti.s.damsex.blog:8080
conti.s.damsex.blog:8880
conti.s.damsex.blog:2052
conti.s.damsex.blog:2082
conti.s.damsex.blog:2086
conti.s.damsex.blog:2095
conti.s.damsex.blog:443
conti.s.damsex.blog:2053
conti.s.damsex.blog:2083
conti.s.damsex.blog:2087
conti.s.damsex.blog:2096
conti.s.damsex.blog:8443

Mutex

VfCEX2UX4q3S

Attributes

delay
0
install
true
install_file
n1qsp9.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  91c66a734756f4b5c7e1c033e20fd9d90b3ab6d80c02d2394c299981f962d6ed
- Size 45KB
- SHA256 91c66a734756f4b5c7e1c033e20fd9d90b3ab6d80c02d2394c299981f962d6ed
- MD5 4a8291a7a9fd520850d7852aaa75efbe
- SHA1 397f4ae7033bdcfae9c2fac198cff657a20e57da
- SHA512 a35fb7f597eaa2755702ccafe1d587ff527903f56b6a391c15d5ed8d270ef1f66b24dd08e6d101357b070feb3f374954c6d373c3cb19994cc60f9082a39160ff
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMSPI5rjbegX3i3wvjitao/SQ9MmBDZsx:EulCJTHl42agG5/bhXS3wvjOaoKQZdsx
- TLSH
  T1EB23290037E8C12BE2BE5F78A9F26145867AF6637603D64D2CC4419B1723FC59A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2