asyncrat | c2e55ccb8b5fb19a8341f5459cd0895071db51e345b35efc42ecdceff7b7f314

Sharing

Copy URL Twitter E-mail

General

Target
c2e55ccb8b5fb19a8341f5459cd0895071db51e345b35efc42ecdceff7b7f314
Size 45KB
Sample260712-c5a66sbz8m
SHA256 c2e55ccb8b5fb19a8341f5459cd0895071db51e345b35efc42ecdceff7b7f314
MD5 829ffb993921ff5e5c6773d755ec859b
SHA1 17aa288abcce748e38b7e4760274c5404856b41c
SHA512 4c7158091d365c800351839a270efce5035306134709f3bd1d1b7aeb8814d154951c9e7698c1c7734aac864c4fc5ebc5af39f8bfc5bd707fe344b2066fad9228
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAhxNZGE9HuPIdzjbfg+3iwWGRHbaHsBDZcx:UuKWgSJTwRf2RpV3d3bo+SiOqdcx
TLSH
T1B2232A003BE8823BF2BE4FB898F26145467AF5637602D9891CC451DB5623FC6D6426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s.damsex.blog:80
s.damsex.blog:22
s.damsex.blog:8080
s.damsex.blog:8880
s.damsex.blog:2052
s.damsex.blog:2082
s.damsex.blog:2086
s.damsex.blog:2095
s.damsex.blog:443
s.damsex.blog:2053
s.damsex.blog:2083
s.damsex.blog:2087
s.damsex.blog:2096
s.damsex.blog:8443
www.s.damsex.blog:80
www.s.damsex.blog:22
www.s.damsex.blog:8080
www.s.damsex.blog:8880
www.s.damsex.blog:2052
www.s.damsex.blog:2082
www.s.damsex.blog:2086
www.s.damsex.blog:2095
www.s.damsex.blog:443
www.s.damsex.blog:2053
www.s.damsex.blog:2083
www.s.damsex.blog:2087
www.s.damsex.blog:2096
www.s.damsex.blog:8443
triton.s.damsex.blog:80
triton.s.damsex.blog:22
triton.s.damsex.blog:8080
triton.s.damsex.blog:8880
triton.s.damsex.blog:2052
triton.s.damsex.blog:2082
triton.s.damsex.blog:2086
triton.s.damsex.blog:2095
triton.s.damsex.blog:443
triton.s.damsex.blog:2053
triton.s.damsex.blog:2083
triton.s.damsex.blog:2087
triton.s.damsex.blog:2096
triton.s.damsex.blog:8443
blacklotus.s.damsex.blog:80
blacklotus.s.damsex.blog:22
blacklotus.s.damsex.blog:8080
blacklotus.s.damsex.blog:8880
blacklotus.s.damsex.blog:2052
blacklotus.s.damsex.blog:2082
blacklotus.s.damsex.blog:2086
blacklotus.s.damsex.blog:2095
blacklotus.s.damsex.blog:443
blacklotus.s.damsex.blog:2053
blacklotus.s.damsex.blog:2083
blacklotus.s.damsex.blog:2087
blacklotus.s.damsex.blog:2096
blacklotus.s.damsex.blog:8443
nimda.s.damsex.blog:80
nimda.s.damsex.blog:22
nimda.s.damsex.blog:8080
nimda.s.damsex.blog:8880
nimda.s.damsex.blog:2052
nimda.s.damsex.blog:2082
nimda.s.damsex.blog:2086
nimda.s.damsex.blog:2095
nimda.s.damsex.blog:443
nimda.s.damsex.blog:2053
nimda.s.damsex.blog:2083
nimda.s.damsex.blog:2087
nimda.s.damsex.blog:2096
nimda.s.damsex.blog:8443
sasser.s.damsex.blog:80
sasser.s.damsex.blog:22
sasser.s.damsex.blog:8080
sasser.s.damsex.blog:8880
sasser.s.damsex.blog:2052
sasser.s.damsex.blog:2082
sasser.s.damsex.blog:2086
sasser.s.damsex.blog:2095
sasser.s.damsex.blog:443
sasser.s.damsex.blog:2053
sasser.s.damsex.blog:2083
sasser.s.damsex.blog:2087
sasser.s.damsex.blog:2096
sasser.s.damsex.blog:8443

Mutex

yaqyENScGLSP

Attributes

delay
0
install
true
install_file
jzx7vqcn.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c2e55ccb8b5fb19a8341f5459cd0895071db51e345b35efc42ecdceff7b7f314
- Size 45KB
- SHA256 c2e55ccb8b5fb19a8341f5459cd0895071db51e345b35efc42ecdceff7b7f314
- MD5 829ffb993921ff5e5c6773d755ec859b
- SHA1 17aa288abcce748e38b7e4760274c5404856b41c
- SHA512 4c7158091d365c800351839a270efce5035306134709f3bd1d1b7aeb8814d154951c9e7698c1c7734aac864c4fc5ebc5af39f8bfc5bd707fe344b2066fad9228
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAhxNZGE9HuPIdzjbfg+3iwWGRHbaHsBDZcx:UuKWgSJTwRf2RpV3d3bo+SiOqdcx
- TLSH
  T1B2232A003BE8823BF2BE4FB898F26145467AF5637602D9891CC451DB5623FC6D6426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2