asyncrat | c0b46714d20acc92472f6e2d4c35b081563d2e04642eae456f9a22e3512dd552

Sharing

Copy URL Twitter E-mail

General

Target
c0b46714d20acc92472f6e2d4c35b081563d2e04642eae456f9a22e3512dd552
Size 45KB
Sample260714-s2wlpsfx8p
SHA256 c0b46714d20acc92472f6e2d4c35b081563d2e04642eae456f9a22e3512dd552
MD5 a293c7b2663235ae0686a5a657ba7395
SHA1 1d442aaa176be80f1edcb806693cd19bcd7546c2
SHA512 e838fdcf00644c762747ec498a09e59b29cb0f0046730a9789341e0e24bdca7501a6d0c370d2ff1b0c6f51d4de0ed87b729525e93b325964d527db8cf823df48
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFFeeXKSocbbbQtN8/nPI6kzjb5gX3iGdMmG4MzMFOO:cu7e5TH2A2deH2tNKA6k3bWXSGdzdODK
TLSH
T19A232B003BE8C12BF2BE4F7859F26145867AF6632603D54A1CC451DB5723FC68652AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

javsub.blog:80
javsub.blog:22
javsub.blog:8080
javsub.blog:8880
javsub.blog:2052
javsub.blog:2082
javsub.blog:2086
javsub.blog:2095
javsub.blog:443
javsub.blog:2053
javsub.blog:2083
javsub.blog:2087
javsub.blog:2096
javsub.blog:8443
www.javsub.blog:80
www.javsub.blog:22
www.javsub.blog:8080
www.javsub.blog:8880
www.javsub.blog:2052
www.javsub.blog:2082
www.javsub.blog:2086
www.javsub.blog:2095
www.javsub.blog:443
www.javsub.blog:2053
www.javsub.blog:2083
www.javsub.blog:2087
www.javsub.blog:2096
www.javsub.blog:8443
shamoon.javsub.blog:80
shamoon.javsub.blog:22
shamoon.javsub.blog:8080
shamoon.javsub.blog:8880
shamoon.javsub.blog:2052
shamoon.javsub.blog:2082
shamoon.javsub.blog:2086
shamoon.javsub.blog:2095
shamoon.javsub.blog:443
shamoon.javsub.blog:2053
shamoon.javsub.blog:2083
shamoon.javsub.blog:2087
shamoon.javsub.blog:2096
shamoon.javsub.blog:8443
melissa.javsub.blog:80
melissa.javsub.blog:22
melissa.javsub.blog:8080
melissa.javsub.blog:8880
melissa.javsub.blog:2052
melissa.javsub.blog:2082
melissa.javsub.blog:2086
melissa.javsub.blog:2095
melissa.javsub.blog:443
melissa.javsub.blog:2053
melissa.javsub.blog:2083
melissa.javsub.blog:2087
melissa.javsub.blog:2096
melissa.javsub.blog:8443
invasive.javsub.blog:80
invasive.javsub.blog:22
invasive.javsub.blog:8080
invasive.javsub.blog:8880
invasive.javsub.blog:2052
invasive.javsub.blog:2082
invasive.javsub.blog:2086
invasive.javsub.blog:2095
invasive.javsub.blog:443
invasive.javsub.blog:2053
invasive.javsub.blog:2083
invasive.javsub.blog:2087
invasive.javsub.blog:2096
invasive.javsub.blog:8443

Mutex

oIWTW4k3LquG

Attributes

delay
0
install
true
install_file
l5ztx.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c0b46714d20acc92472f6e2d4c35b081563d2e04642eae456f9a22e3512dd552
- Size 45KB
- SHA256 c0b46714d20acc92472f6e2d4c35b081563d2e04642eae456f9a22e3512dd552
- MD5 a293c7b2663235ae0686a5a657ba7395
- SHA1 1d442aaa176be80f1edcb806693cd19bcd7546c2
- SHA512 e838fdcf00644c762747ec498a09e59b29cb0f0046730a9789341e0e24bdca7501a6d0c370d2ff1b0c6f51d4de0ed87b729525e93b325964d527db8cf823df48
- SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFFeeXKSocbbbQtN8/nPI6kzjb5gX3iGdMmG4MzMFOO:cu7e5TH2A2deH2tNKA6k3bWXSGdzdODK
- TLSH
  T19A232B003BE8C12BF2BE4F7859F26145867AF6632603D54A1CC451DB5723FC68652AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2