asyncrat | 7a860862aed7b77d3251a5ac18ad47c04de39a7399367ddf9c3ac9c03079917c

Sharing

Copy URL Twitter E-mail

General

Target
7a860862aed7b77d3251a5ac18ad47c04de39a7399367ddf9c3ac9c03079917c
Size 45KB
Sample260712-d1n3xaew6w
SHA256 7a860862aed7b77d3251a5ac18ad47c04de39a7399367ddf9c3ac9c03079917c
MD5 8452009472f83e2d6fecb1ac6505b277
SHA1 462abe44b8d84be5a0484761c209c07fef3cb249
SHA512 8e316133bd167e80456e92a06ecec5d9c62fdd238dabc33997502b5461ec814dd3cabde7165c91ea87015d892a57bb8b037a288c11e1c4350daf8efad3b78755
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw03HE4SVoOPIGQzjb3gk3iq84PglnQk0T0cETd+BDo:ku40ZTXEb2AUZo3GQ3bQkSqZP6E0cDdO
TLSH
T17E231B003BE8C12BF2BE4F789DF26145867AF6636603D9491CC452DB5713FC68A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s.damsex.blog:80
s.damsex.blog:22
s.damsex.blog:8080
s.damsex.blog:8880
s.damsex.blog:2052
s.damsex.blog:2082
s.damsex.blog:2086
s.damsex.blog:2095
s.damsex.blog:443
s.damsex.blog:2053
s.damsex.blog:2083
s.damsex.blog:2087
s.damsex.blog:2096
s.damsex.blog:8443
www.s.damsex.blog:80
www.s.damsex.blog:22
www.s.damsex.blog:8080
www.s.damsex.blog:8880
www.s.damsex.blog:2052
www.s.damsex.blog:2082
www.s.damsex.blog:2086
www.s.damsex.blog:2095
www.s.damsex.blog:443
www.s.damsex.blog:2053
www.s.damsex.blog:2083
www.s.damsex.blog:2087
www.s.damsex.blog:2096
www.s.damsex.blog:8443
hacker.s.damsex.blog:80
hacker.s.damsex.blog:22
hacker.s.damsex.blog:8080
hacker.s.damsex.blog:8880
hacker.s.damsex.blog:2052
hacker.s.damsex.blog:2082
hacker.s.damsex.blog:2086
hacker.s.damsex.blog:2095
hacker.s.damsex.blog:443
hacker.s.damsex.blog:2053
hacker.s.damsex.blog:2083
hacker.s.damsex.blog:2087
hacker.s.damsex.blog:2096
hacker.s.damsex.blog:8443
darkside.s.damsex.blog:80
darkside.s.damsex.blog:22
darkside.s.damsex.blog:8080
darkside.s.damsex.blog:8880
darkside.s.damsex.blog:2052
darkside.s.damsex.blog:2082
darkside.s.damsex.blog:2086
darkside.s.damsex.blog:2095
darkside.s.damsex.blog:443
darkside.s.damsex.blog:2053
darkside.s.damsex.blog:2083
darkside.s.damsex.blog:2087
darkside.s.damsex.blog:2096
darkside.s.damsex.blog:8443
locky.s.damsex.blog:80
locky.s.damsex.blog:22
locky.s.damsex.blog:8080
locky.s.damsex.blog:8880
locky.s.damsex.blog:2052
locky.s.damsex.blog:2082
locky.s.damsex.blog:2086
locky.s.damsex.blog:2095
locky.s.damsex.blog:443
locky.s.damsex.blog:2053
locky.s.damsex.blog:2083
locky.s.damsex.blog:2087
locky.s.damsex.blog:2096
locky.s.damsex.blog:8443
industroyer.s.damsex.blog:80
industroyer.s.damsex.blog:22
industroyer.s.damsex.blog:8080
industroyer.s.damsex.blog:8880
industroyer.s.damsex.blog:2052
industroyer.s.damsex.blog:2082
industroyer.s.damsex.blog:2086
industroyer.s.damsex.blog:2095
industroyer.s.damsex.blog:443
industroyer.s.damsex.blog:2053
industroyer.s.damsex.blog:2083
industroyer.s.damsex.blog:2087
industroyer.s.damsex.blog:2096
industroyer.s.damsex.blog:8443

Mutex

s1g4tS5rv6ec

Attributes

delay
0
install
true
install_file
gzlem.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  7a860862aed7b77d3251a5ac18ad47c04de39a7399367ddf9c3ac9c03079917c
- Size 45KB
- SHA256 7a860862aed7b77d3251a5ac18ad47c04de39a7399367ddf9c3ac9c03079917c
- MD5 8452009472f83e2d6fecb1ac6505b277
- SHA1 462abe44b8d84be5a0484761c209c07fef3cb249
- SHA512 8e316133bd167e80456e92a06ecec5d9c62fdd238dabc33997502b5461ec814dd3cabde7165c91ea87015d892a57bb8b037a288c11e1c4350daf8efad3b78755
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw03HE4SVoOPIGQzjb3gk3iq84PglnQk0T0cETd+BDo:ku40ZTXEb2AUZo3GQ3bQkSqZP6E0cDdO
- TLSH
  T17E231B003BE8C12BF2BE4F789DF26145867AF6636603D9491CC452DB5713FC68A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2