asyncrat | bf7606d3d7b1ec5c9af112188b4e4a29779985765780896f5c1b28109c5bac1a

Sharing

Copy URL Twitter E-mail

General

Target
bf7606d3d7b1ec5c9af112188b4e4a29779985765780896f5c1b28109c5bac1a
Size 45KB
Sample260712-decsracs3j
SHA256 bf7606d3d7b1ec5c9af112188b4e4a29779985765780896f5c1b28109c5bac1a
MD5 3d09849aad6ddd683a988db4ede242a1
SHA1 7c5170b7c31bc6dad5cc523d8614db6c4885eab6
SHA512 abb25de58281af20ad2d8e377aab6cacf03ef464028a52aa5277a890006c14f450b7cc22afc5cad1e02027534a8744d47dcdccce5ea446ecf3aa2c21167da40e
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFPJXo5EayPIIzjbkgX3iDJZxZ3ne4LjrsBDZEx:MuLAZTnbg2KQEabI3brXSt/Z3TPrqdEx
TLSH
T1C4232C003BE8812BF2BE4F78A9F26145467EF5636603D5891CC411DB5723FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s.damsex.blog:80
s.damsex.blog:22
s.damsex.blog:8080
s.damsex.blog:8880
s.damsex.blog:2052
s.damsex.blog:2082
s.damsex.blog:2086
s.damsex.blog:2095
s.damsex.blog:443
s.damsex.blog:2053
s.damsex.blog:2083
s.damsex.blog:2087
s.damsex.blog:2096
s.damsex.blog:8443
www.s.damsex.blog:80
www.s.damsex.blog:22
www.s.damsex.blog:8080
www.s.damsex.blog:8880
www.s.damsex.blog:2052
www.s.damsex.blog:2082
www.s.damsex.blog:2086
www.s.damsex.blog:2095
www.s.damsex.blog:443
www.s.damsex.blog:2053
www.s.damsex.blog:2083
www.s.damsex.blog:2087
www.s.damsex.blog:2096
www.s.damsex.blog:8443
blacklotus.s.damsex.blog:80
blacklotus.s.damsex.blog:22
blacklotus.s.damsex.blog:8080
blacklotus.s.damsex.blog:8880
blacklotus.s.damsex.blog:2052
blacklotus.s.damsex.blog:2082
blacklotus.s.damsex.blog:2086
blacklotus.s.damsex.blog:2095
blacklotus.s.damsex.blog:443
blacklotus.s.damsex.blog:2053
blacklotus.s.damsex.blog:2083
blacklotus.s.damsex.blog:2087
blacklotus.s.damsex.blog:2096
blacklotus.s.damsex.blog:8443
shamoon.s.damsex.blog:80
shamoon.s.damsex.blog:22
shamoon.s.damsex.blog:8080
shamoon.s.damsex.blog:8880
shamoon.s.damsex.blog:2052
shamoon.s.damsex.blog:2082
shamoon.s.damsex.blog:2086
shamoon.s.damsex.blog:2095
shamoon.s.damsex.blog:443
shamoon.s.damsex.blog:2053
shamoon.s.damsex.blog:2083
shamoon.s.damsex.blog:2087
shamoon.s.damsex.blog:2096
shamoon.s.damsex.blog:8443
fakeupdates.s.damsex.blog:80
fakeupdates.s.damsex.blog:22
fakeupdates.s.damsex.blog:8080
fakeupdates.s.damsex.blog:8880
fakeupdates.s.damsex.blog:2052
fakeupdates.s.damsex.blog:2082
fakeupdates.s.damsex.blog:2086
fakeupdates.s.damsex.blog:2095
fakeupdates.s.damsex.blog:443
fakeupdates.s.damsex.blog:2053
fakeupdates.s.damsex.blog:2083
fakeupdates.s.damsex.blog:2087
fakeupdates.s.damsex.blog:2096
fakeupdates.s.damsex.blog:8443

Mutex

3GuvxqJiNWko

Attributes

delay
0
install
true
install_file
1mr80.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  bf7606d3d7b1ec5c9af112188b4e4a29779985765780896f5c1b28109c5bac1a
- Size 45KB
- SHA256 bf7606d3d7b1ec5c9af112188b4e4a29779985765780896f5c1b28109c5bac1a
- MD5 3d09849aad6ddd683a988db4ede242a1
- SHA1 7c5170b7c31bc6dad5cc523d8614db6c4885eab6
- SHA512 abb25de58281af20ad2d8e377aab6cacf03ef464028a52aa5277a890006c14f450b7cc22afc5cad1e02027534a8744d47dcdccce5ea446ecf3aa2c21167da40e
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFPJXo5EayPIIzjbkgX3iDJZxZ3ne4LjrsBDZEx:MuLAZTnbg2KQEabI3brXSt/Z3TPrqdEx
- TLSH
  T1C4232C003BE8812BF2BE4F78A9F26145467EF5636603D5891CC411DB5723FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2