asyncrat | 93304b831b33aa7a3ec578172c7c522c5a14068ed8de679a1a1c95d0016b630c

Sharing

Copy URL Twitter E-mail

General

Target
93304b831b33aa7a3ec578172c7c522c5a14068ed8de679a1a1c95d0016b630c
Size 45KB
Sample260715-n4physez5v
SHA256 93304b831b33aa7a3ec578172c7c522c5a14068ed8de679a1a1c95d0016b630c
MD5 69d79d11591b70f803c6e6ff1a04bacd
SHA1 47d2d79edeab223dd129ef5cb4fd674355c22fe6
SHA512 4ddd8b36c5f524b81f63dda1fc6e3ad6450d569608e3a11ebdf6f873a4affe54c1f0f9db0ec8ff4cb7efa1e02e22c6f529ea37086b5fef18fb02dda3d8c2eaf0
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9K9Yikq/ztOPIYzjbMRg33ircQmmqqcHQkHMuXqrGBM:0uPrpT/qY23ali3Y3b73SH0qrkHMwd8x
TLSH
T134232B003BE9C12BF2BE5F7899F22105857AF2672603D64A1CC451DB5723FC69A429FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

porn-th.com:80
porn-th.com:22
porn-th.com:8080
porn-th.com:8880
porn-th.com:2052
porn-th.com:2082
porn-th.com:2086
porn-th.com:2095
porn-th.com:443
porn-th.com:2053
porn-th.com:2083
porn-th.com:2087
porn-th.com:2096
porn-th.com:8443
www.porn-th.com:80
www.porn-th.com:22
www.porn-th.com:8080
www.porn-th.com:8880
www.porn-th.com:2052
www.porn-th.com:2082
www.porn-th.com:2086
www.porn-th.com:2095
www.porn-th.com:443
www.porn-th.com:2053
www.porn-th.com:2083
www.porn-th.com:2087
www.porn-th.com:2096
www.porn-th.com:8443
malware.porn-th.com:80
malware.porn-th.com:22
malware.porn-th.com:8080
malware.porn-th.com:8880
malware.porn-th.com:2052
malware.porn-th.com:2082
malware.porn-th.com:2086
malware.porn-th.com:2095
malware.porn-th.com:443
malware.porn-th.com:2053
malware.porn-th.com:2083
malware.porn-th.com:2087
malware.porn-th.com:2096
malware.porn-th.com:8443
industroyer.porn-th.com:80
industroyer.porn-th.com:22
industroyer.porn-th.com:8080
industroyer.porn-th.com:8880
industroyer.porn-th.com:2052
industroyer.porn-th.com:2082
industroyer.porn-th.com:2086
industroyer.porn-th.com:2095
industroyer.porn-th.com:443
industroyer.porn-th.com:2053
industroyer.porn-th.com:2083
industroyer.porn-th.com:2087
industroyer.porn-th.com:2096
industroyer.porn-th.com:8443
qakbot.porn-th.com:80
qakbot.porn-th.com:22
qakbot.porn-th.com:8080
qakbot.porn-th.com:8880
qakbot.porn-th.com:2052
qakbot.porn-th.com:2082
qakbot.porn-th.com:2086
qakbot.porn-th.com:2095
qakbot.porn-th.com:443
qakbot.porn-th.com:2053
qakbot.porn-th.com:2083
qakbot.porn-th.com:2087
qakbot.porn-th.com:2096
qakbot.porn-th.com:8443

Mutex

jjkmKPYfH2vt

Attributes

delay
0
install
true
install_file
84kpesg.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  93304b831b33aa7a3ec578172c7c522c5a14068ed8de679a1a1c95d0016b630c
- Size 45KB
- SHA256 93304b831b33aa7a3ec578172c7c522c5a14068ed8de679a1a1c95d0016b630c
- MD5 69d79d11591b70f803c6e6ff1a04bacd
- SHA1 47d2d79edeab223dd129ef5cb4fd674355c22fe6
- SHA512 4ddd8b36c5f524b81f63dda1fc6e3ad6450d569608e3a11ebdf6f873a4affe54c1f0f9db0ec8ff4cb7efa1e02e22c6f529ea37086b5fef18fb02dda3d8c2eaf0
- SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9K9Yikq/ztOPIYzjbMRg33ircQmmqqcHQkHMuXqrGBM:0uPrpT/qY23ali3Y3b73SH0qrkHMwd8x
- TLSH
  T134232B003BE9C12BF2BE5F7899F22105857AF2672603D64A1CC451DB5723FC69A429FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2