asyncrat | 6994d4ef3ffab725e9267ecaa84284e29d6a459109b34931dc618b8a73d2753b

Sharing

Copy URL Twitter E-mail

General

Target
6994d4ef3ffab725e9267ecaa84284e29d6a459109b34931dc618b8a73d2753b
Size 45KB
Sample260714-hm497aav5t
SHA256 6994d4ef3ffab725e9267ecaa84284e29d6a459109b34931dc618b8a73d2753b
MD5 56128defaf98b5cc30b1cb7898407a97
SHA1 92090f203e832806519493a597a241e7fc46cce5
SHA512 fd73c76271bbf08415c1492c1df7bca3965cfb44e53d707690d10d9a88fbb59ba8f19a05f565cbb03c346214afeac70f6bce62f21bb7f942d41923edc8e0e8dc
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9tcQSCBznqNLPI7zjbQgX3iI+jlRYnQ4jeBDZ8x:0uPrpT/qY2cc9UqC73bXXSBB4jwd8x
TLSH
T127232B003BE8813AF2BE4F74A9F26145467AF6632603D54D2CC451DB5723FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cdn.cd-vs.com:80
cdn.cd-vs.com:22
cdn.cd-vs.com:8080
cdn.cd-vs.com:8880
cdn.cd-vs.com:2052
cdn.cd-vs.com:2082
cdn.cd-vs.com:2086
cdn.cd-vs.com:2095
cdn.cd-vs.com:443
cdn.cd-vs.com:2053
cdn.cd-vs.com:2083
cdn.cd-vs.com:2087
cdn.cd-vs.com:2096
cdn.cd-vs.com:8443
www.cdn.cd-vs.com:80
www.cdn.cd-vs.com:22
www.cdn.cd-vs.com:8080
www.cdn.cd-vs.com:8880
www.cdn.cd-vs.com:2052
www.cdn.cd-vs.com:2082
www.cdn.cd-vs.com:2086
www.cdn.cd-vs.com:2095
www.cdn.cd-vs.com:443
www.cdn.cd-vs.com:2053
www.cdn.cd-vs.com:2083
www.cdn.cd-vs.com:2087
www.cdn.cd-vs.com:2096
www.cdn.cd-vs.com:8443
triton.cdn.cd-vs.com:80
triton.cdn.cd-vs.com:22
triton.cdn.cd-vs.com:8080
triton.cdn.cd-vs.com:8880
triton.cdn.cd-vs.com:2052
triton.cdn.cd-vs.com:2082
triton.cdn.cd-vs.com:2086
triton.cdn.cd-vs.com:2095
triton.cdn.cd-vs.com:443
triton.cdn.cd-vs.com:2053
triton.cdn.cd-vs.com:2083
triton.cdn.cd-vs.com:2087
triton.cdn.cd-vs.com:2096
triton.cdn.cd-vs.com:8443
locky.cdn.cd-vs.com:80
locky.cdn.cd-vs.com:22
locky.cdn.cd-vs.com:8080
locky.cdn.cd-vs.com:8880
locky.cdn.cd-vs.com:2052
locky.cdn.cd-vs.com:2082
locky.cdn.cd-vs.com:2086
locky.cdn.cd-vs.com:2095
locky.cdn.cd-vs.com:443
locky.cdn.cd-vs.com:2053
locky.cdn.cd-vs.com:2083
locky.cdn.cd-vs.com:2087
locky.cdn.cd-vs.com:2096
locky.cdn.cd-vs.com:8443
cl0p.cdn.cd-vs.com:80
cl0p.cdn.cd-vs.com:22
cl0p.cdn.cd-vs.com:8080
cl0p.cdn.cd-vs.com:8880
cl0p.cdn.cd-vs.com:2052
cl0p.cdn.cd-vs.com:2082
cl0p.cdn.cd-vs.com:2086
cl0p.cdn.cd-vs.com:2095
cl0p.cdn.cd-vs.com:443
cl0p.cdn.cd-vs.com:2053
cl0p.cdn.cd-vs.com:2083
cl0p.cdn.cd-vs.com:2087
cl0p.cdn.cd-vs.com:2096
cl0p.cdn.cd-vs.com:8443

Mutex

cBc5WOS5dHrr

Attributes

delay
0
install
true
install_file
ej2ioqz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6994d4ef3ffab725e9267ecaa84284e29d6a459109b34931dc618b8a73d2753b
- Size 45KB
- SHA256 6994d4ef3ffab725e9267ecaa84284e29d6a459109b34931dc618b8a73d2753b
- MD5 56128defaf98b5cc30b1cb7898407a97
- SHA1 92090f203e832806519493a597a241e7fc46cce5
- SHA512 fd73c76271bbf08415c1492c1df7bca3965cfb44e53d707690d10d9a88fbb59ba8f19a05f565cbb03c346214afeac70f6bce62f21bb7f942d41923edc8e0e8dc
- SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9tcQSCBznqNLPI7zjbQgX3iI+jlRYnQ4jeBDZ8x:0uPrpT/qY2cc9UqC73bXXSBB4jwd8x
- TLSH
  T127232B003BE8813AF2BE4F74A9F26145467AF6632603D54D2CC451DB5723FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2