asyncrat | 944bdc5c375a6503b3290180cf3c66de3d471e0e619bfb7cf5351ada4615476b

Sharing

Copy URL Twitter E-mail

General

Target
944bdc5c375a6503b3290180cf3c66de3d471e0e619bfb7cf5351ada4615476b
Size 45KB
Sample260712-d65ylscw7p
SHA256 944bdc5c375a6503b3290180cf3c66de3d471e0e619bfb7cf5351ada4615476b
MD5 90071fc11f780178d7d122c61bacbbd7
SHA1 37d26bfcb17428e75cfb70ab065b5e905614bce1
SHA512 f81468b58791b7cf3f3332cbc4584c86a8c559e311f53c351808b0f6ee8478b98dd57c5bb8bb57281d0aec0cc5f961d9a395a60f267aa972cf11f16aa858a1b0
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF33FoDEaOPIBzjb/gX3iAWeySVXilVR4SBDZEx:MuLAZTnbg2CKEa3B3bIXSAWeBVXiRdEx
TLSH
T1FC231A003BE8822BF2BE4F78ADF26105467AF5A37603D5492CC451D75613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s.damsex.blog:80
s.damsex.blog:22
s.damsex.blog:8080
s.damsex.blog:8880
s.damsex.blog:2052
s.damsex.blog:2082
s.damsex.blog:2086
s.damsex.blog:2095
s.damsex.blog:443
s.damsex.blog:2053
s.damsex.blog:2083
s.damsex.blog:2087
s.damsex.blog:2096
s.damsex.blog:8443
www.s.damsex.blog:80
www.s.damsex.blog:22
www.s.damsex.blog:8080
www.s.damsex.blog:8880
www.s.damsex.blog:2052
www.s.damsex.blog:2082
www.s.damsex.blog:2086
www.s.damsex.blog:2095
www.s.damsex.blog:443
www.s.damsex.blog:2053
www.s.damsex.blog:2083
www.s.damsex.blog:2087
www.s.damsex.blog:2096
www.s.damsex.blog:8443
hermeticwiper.s.damsex.blog:80
hermeticwiper.s.damsex.blog:22
hermeticwiper.s.damsex.blog:8080
hermeticwiper.s.damsex.blog:8880
hermeticwiper.s.damsex.blog:2052
hermeticwiper.s.damsex.blog:2082
hermeticwiper.s.damsex.blog:2086
hermeticwiper.s.damsex.blog:2095
hermeticwiper.s.damsex.blog:443
hermeticwiper.s.damsex.blog:2053
hermeticwiper.s.damsex.blog:2083
hermeticwiper.s.damsex.blog:2087
hermeticwiper.s.damsex.blog:2096
hermeticwiper.s.damsex.blog:8443
connect.s.damsex.blog:80
connect.s.damsex.blog:22
connect.s.damsex.blog:8080
connect.s.damsex.blog:8880
connect.s.damsex.blog:2052
connect.s.damsex.blog:2082
connect.s.damsex.blog:2086
connect.s.damsex.blog:2095
connect.s.damsex.blog:443
connect.s.damsex.blog:2053
connect.s.damsex.blog:2083
connect.s.damsex.blog:2087
connect.s.damsex.blog:2096
connect.s.damsex.blog:8443
conti.s.damsex.blog:80
conti.s.damsex.blog:22
conti.s.damsex.blog:8080
conti.s.damsex.blog:8880
conti.s.damsex.blog:2052
conti.s.damsex.blog:2082
conti.s.damsex.blog:2086
conti.s.damsex.blog:2095
conti.s.damsex.blog:443
conti.s.damsex.blog:2053
conti.s.damsex.blog:2083
conti.s.damsex.blog:2087
conti.s.damsex.blog:2096
conti.s.damsex.blog:8443

Mutex

UbWoqk4reSDP

Attributes

delay
0
install
true
install_file
ka1l2.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  944bdc5c375a6503b3290180cf3c66de3d471e0e619bfb7cf5351ada4615476b
- Size 45KB
- SHA256 944bdc5c375a6503b3290180cf3c66de3d471e0e619bfb7cf5351ada4615476b
- MD5 90071fc11f780178d7d122c61bacbbd7
- SHA1 37d26bfcb17428e75cfb70ab065b5e905614bce1
- SHA512 f81468b58791b7cf3f3332cbc4584c86a8c559e311f53c351808b0f6ee8478b98dd57c5bb8bb57281d0aec0cc5f961d9a395a60f267aa972cf11f16aa858a1b0
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF33FoDEaOPIBzjb/gX3iAWeySVXilVR4SBDZEx:MuLAZTnbg2CKEa3B3bIXSAWeBVXiRdEx
- TLSH
  T1FC231A003BE8822BF2BE4F78ADF26105467AF5A37603D5492CC451D75613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2