asyncrat | 06362b3dfc2674336caf23d8702cc57af95e0922924bb0caf8ba441e75d27e3e

Sharing

Copy URL Twitter E-mail

General

Target
06362b3dfc2674336caf23d8702cc57af95e0922924bb0caf8ba441e75d27e3e
Size 45KB
Sample260712-tap6aacw6l
SHA256 06362b3dfc2674336caf23d8702cc57af95e0922924bb0caf8ba441e75d27e3e
MD5 4c63fcfd355d0aa2c37c1d1cbef6b609
SHA1 b0fb5b3f9e8aec97db53e354ef1dae05bfa8ceab
SHA512 def47bd21cc50b03071b54b4905b7c7de289e002b2b7bee91d80b7f8b76631986778dd63a76eebf6ea015cfa541946c8c0c6c2b4f0b7012cbcdfda4c459fec36
SSDEEP 768:Iu6RaepTPYzbs8WU+Xaamo2q1/hiQDBZwYqEdRPIgzjbzgX3iZWu1Gb6tPDBDZox:Iu6YepTPso2EOYqEdOg3bsXSZF06tPF
TLSH
T15323090037E8822BF2BE4F789CF26245867AB5633603D5591CC442DB5713FC69B52AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s.damsex.blog:80
s.damsex.blog:22
s.damsex.blog:8080
s.damsex.blog:8880
s.damsex.blog:2052
s.damsex.blog:2082
s.damsex.blog:2086
s.damsex.blog:2095
s.damsex.blog:443
s.damsex.blog:2053
s.damsex.blog:2083
s.damsex.blog:2087
s.damsex.blog:2096
s.damsex.blog:8443
www.s.damsex.blog:80
www.s.damsex.blog:22
www.s.damsex.blog:8080
www.s.damsex.blog:8880
www.s.damsex.blog:2052
www.s.damsex.blog:2082
www.s.damsex.blog:2086
www.s.damsex.blog:2095
www.s.damsex.blog:443
www.s.damsex.blog:2053
www.s.damsex.blog:2083
www.s.damsex.blog:2087
www.s.damsex.blog:2096
www.s.damsex.blog:8443
sasser.s.damsex.blog:80
sasser.s.damsex.blog:22
sasser.s.damsex.blog:8080
sasser.s.damsex.blog:8880
sasser.s.damsex.blog:2052
sasser.s.damsex.blog:2082
sasser.s.damsex.blog:2086
sasser.s.damsex.blog:2095
sasser.s.damsex.blog:443
sasser.s.damsex.blog:2053
sasser.s.damsex.blog:2083
sasser.s.damsex.blog:2087
sasser.s.damsex.blog:2096
sasser.s.damsex.blog:8443
gootloader.s.damsex.blog:80
gootloader.s.damsex.blog:22
gootloader.s.damsex.blog:8080
gootloader.s.damsex.blog:8880
gootloader.s.damsex.blog:2052
gootloader.s.damsex.blog:2082
gootloader.s.damsex.blog:2086
gootloader.s.damsex.blog:2095
gootloader.s.damsex.blog:443
gootloader.s.damsex.blog:2053
gootloader.s.damsex.blog:2083
gootloader.s.damsex.blog:2087
gootloader.s.damsex.blog:2096
gootloader.s.damsex.blog:8443
stuxnet.s.damsex.blog:80
stuxnet.s.damsex.blog:22
stuxnet.s.damsex.blog:8080
stuxnet.s.damsex.blog:8880
stuxnet.s.damsex.blog:2052
stuxnet.s.damsex.blog:2082
stuxnet.s.damsex.blog:2086
stuxnet.s.damsex.blog:2095
stuxnet.s.damsex.blog:443
stuxnet.s.damsex.blog:2053
stuxnet.s.damsex.blog:2083
stuxnet.s.damsex.blog:2087
stuxnet.s.damsex.blog:2096
stuxnet.s.damsex.blog:8443

Mutex

Q60V4I1OgI7Y

Attributes

delay
0
install
true
install_file
fkguvba1.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  06362b3dfc2674336caf23d8702cc57af95e0922924bb0caf8ba441e75d27e3e
- Size 45KB
- SHA256 06362b3dfc2674336caf23d8702cc57af95e0922924bb0caf8ba441e75d27e3e
- MD5 4c63fcfd355d0aa2c37c1d1cbef6b609
- SHA1 b0fb5b3f9e8aec97db53e354ef1dae05bfa8ceab
- SHA512 def47bd21cc50b03071b54b4905b7c7de289e002b2b7bee91d80b7f8b76631986778dd63a76eebf6ea015cfa541946c8c0c6c2b4f0b7012cbcdfda4c459fec36
- SSDEEP 768:Iu6RaepTPYzbs8WU+Xaamo2q1/hiQDBZwYqEdRPIgzjbzgX3iZWu1Gb6tPDBDZox:Iu6YepTPso2EOYqEdOg3bsXSZF06tPF
- TLSH
  T15323090037E8822BF2BE4F789CF26245867AB5633603D5591CC442DB5713FC69B52AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2