asyncrat | 766418cb9cbef123dd356d579efc5eab265c023ea46dd5c3c36230a84e53e391

Sharing

Copy URL Twitter E-mail

General

Target
766418cb9cbef123dd356d579efc5eab265c023ea46dd5c3c36230a84e53e391
Size 45KB
Sample260714-nsdbjsd18w
SHA256 766418cb9cbef123dd356d579efc5eab265c023ea46dd5c3c36230a84e53e391
MD5 6a643026c88526518323ebf5ed0e8dbc
SHA1 ab7241061d3b07ba918a11cc18c22c4d30273c63
SHA512 6414084a8d002bb3ced84fe4f904fa704986b824e4e125bc163f4104cd2ac482c6a9261957e91974c32d63438ad4f42b89a3b7256f0b4ef931570b31c5443182
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sZo3TMtPIm3jb6gX3iInT/LI7EKfIbABDZ8x:0u1YJTHcw2dU3mTbtXSgT/0AfCd8x
TLSH
T1C8232B0037E8C22BF2BE5F78A8F26145867AF6673603D58E2CC4419B5613FC59A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

porn-th.com:80
porn-th.com:22
porn-th.com:8080
porn-th.com:8880
porn-th.com:2052
porn-th.com:2082
porn-th.com:2086
porn-th.com:2095
porn-th.com:443
porn-th.com:2053
porn-th.com:2083
porn-th.com:2087
porn-th.com:2096
porn-th.com:8443
www.porn-th.com:80
www.porn-th.com:22
www.porn-th.com:8080
www.porn-th.com:8880
www.porn-th.com:2052
www.porn-th.com:2082
www.porn-th.com:2086
www.porn-th.com:2095
www.porn-th.com:443
www.porn-th.com:2053
www.porn-th.com:2083
www.porn-th.com:2087
www.porn-th.com:2096
www.porn-th.com:8443
qbot.porn-th.com:80
qbot.porn-th.com:22
qbot.porn-th.com:8080
qbot.porn-th.com:8880
qbot.porn-th.com:2052
qbot.porn-th.com:2082
qbot.porn-th.com:2086
qbot.porn-th.com:2095
qbot.porn-th.com:443
qbot.porn-th.com:2053
qbot.porn-th.com:2083
qbot.porn-th.com:2087
qbot.porn-th.com:2096
qbot.porn-th.com:8443
shamoon.porn-th.com:80
shamoon.porn-th.com:22
shamoon.porn-th.com:8080
shamoon.porn-th.com:8880
shamoon.porn-th.com:2052
shamoon.porn-th.com:2082
shamoon.porn-th.com:2086
shamoon.porn-th.com:2095
shamoon.porn-th.com:443
shamoon.porn-th.com:2053
shamoon.porn-th.com:2083
shamoon.porn-th.com:2087
shamoon.porn-th.com:2096
shamoon.porn-th.com:8443
cryptolocker.porn-th.com:80
cryptolocker.porn-th.com:22
cryptolocker.porn-th.com:8080
cryptolocker.porn-th.com:8880
cryptolocker.porn-th.com:2052
cryptolocker.porn-th.com:2082
cryptolocker.porn-th.com:2086
cryptolocker.porn-th.com:2095
cryptolocker.porn-th.com:443
cryptolocker.porn-th.com:2053
cryptolocker.porn-th.com:2083
cryptolocker.porn-th.com:2087
cryptolocker.porn-th.com:2096
cryptolocker.porn-th.com:8443

Mutex

Gx9PyXaA24lL

Attributes

delay
0
install
true
install_file
lbtabc.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  766418cb9cbef123dd356d579efc5eab265c023ea46dd5c3c36230a84e53e391
- Size 45KB
- SHA256 766418cb9cbef123dd356d579efc5eab265c023ea46dd5c3c36230a84e53e391
- MD5 6a643026c88526518323ebf5ed0e8dbc
- SHA1 ab7241061d3b07ba918a11cc18c22c4d30273c63
- SHA512 6414084a8d002bb3ced84fe4f904fa704986b824e4e125bc163f4104cd2ac482c6a9261957e91974c32d63438ad4f42b89a3b7256f0b4ef931570b31c5443182
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sZo3TMtPIm3jb6gX3iInT/LI7EKfIbABDZ8x:0u1YJTHcw2dU3mTbtXSgT/0AfCd8x
- TLSH
  T1C8232B0037E8C22BF2BE5F78A8F26145867AF6673603D58E2CC4419B5613FC59A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2