asyncrat | 20dd3aaee41ee4c29546b9b8fa556e8b931d659aafd01e883b704fa23dcf3340

Sharing

Copy URL Twitter E-mail

General

Target
20dd3aaee41ee4c29546b9b8fa556e8b931d659aafd01e883b704fa23dcf3340
Size 45KB
Sample260715-sgcm4aez7n
SHA256 20dd3aaee41ee4c29546b9b8fa556e8b931d659aafd01e883b704fa23dcf3340
MD5 d07549bf9997d8b1bc33fbde9452f44a
SHA1 02227dbe63a775fc29d6e4069722cc732db69211
SHA512 526fc39da656c311aa9ac2ce5546222ebe110c7cced40c237d11973a85996bd26ca5b21942decf3c09ee60fe8c1234530ed17319b3201e0626558b0266ffe4fe
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7SAFcKoabbb4ZhM/RPIAEzjbogX3iFeQaeVXHGO2D:cu7e5TH2A2QSAvQZh6OAE3b/XS8teVRq
TLSH
T1AF232A003BE8C12BF2BE4F7899F26145867AB6633603D54A2CC4529B5713FC6D642AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

pornhd.luxury:80
pornhd.luxury:22
pornhd.luxury:8080
pornhd.luxury:8880
pornhd.luxury:2052
pornhd.luxury:2082
pornhd.luxury:2086
pornhd.luxury:2095
pornhd.luxury:443
pornhd.luxury:2053
pornhd.luxury:2083
pornhd.luxury:2087
pornhd.luxury:2096
pornhd.luxury:8443
www.pornhd.luxury:80
www.pornhd.luxury:22
www.pornhd.luxury:8080
www.pornhd.luxury:8880
www.pornhd.luxury:2052
www.pornhd.luxury:2082
www.pornhd.luxury:2086
www.pornhd.luxury:2095
www.pornhd.luxury:443
www.pornhd.luxury:2053
www.pornhd.luxury:2083
www.pornhd.luxury:2087
www.pornhd.luxury:2096
www.pornhd.luxury:8443
gh0st.pornhd.luxury:80
gh0st.pornhd.luxury:22
gh0st.pornhd.luxury:8080
gh0st.pornhd.luxury:8880
gh0st.pornhd.luxury:2052
gh0st.pornhd.luxury:2082
gh0st.pornhd.luxury:2086
gh0st.pornhd.luxury:2095
gh0st.pornhd.luxury:443
gh0st.pornhd.luxury:2053
gh0st.pornhd.luxury:2083
gh0st.pornhd.luxury:2087
gh0st.pornhd.luxury:2096
gh0st.pornhd.luxury:8443
sasser.pornhd.luxury:80
sasser.pornhd.luxury:22
sasser.pornhd.luxury:8080
sasser.pornhd.luxury:8880
sasser.pornhd.luxury:2052
sasser.pornhd.luxury:2082
sasser.pornhd.luxury:2086
sasser.pornhd.luxury:2095
sasser.pornhd.luxury:443
sasser.pornhd.luxury:2053
sasser.pornhd.luxury:2083
sasser.pornhd.luxury:2087
sasser.pornhd.luxury:2096
sasser.pornhd.luxury:8443
dridex.pornhd.luxury:80
dridex.pornhd.luxury:22
dridex.pornhd.luxury:8080
dridex.pornhd.luxury:8880
dridex.pornhd.luxury:2052
dridex.pornhd.luxury:2082
dridex.pornhd.luxury:2086
dridex.pornhd.luxury:2095
dridex.pornhd.luxury:443
dridex.pornhd.luxury:2053
dridex.pornhd.luxury:2083
dridex.pornhd.luxury:2087
dridex.pornhd.luxury:2096
dridex.pornhd.luxury:8443

Mutex

Els4YNWwuvj8

Attributes

delay
0
install
true
install_file
as4nz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  20dd3aaee41ee4c29546b9b8fa556e8b931d659aafd01e883b704fa23dcf3340
- Size 45KB
- SHA256 20dd3aaee41ee4c29546b9b8fa556e8b931d659aafd01e883b704fa23dcf3340
- MD5 d07549bf9997d8b1bc33fbde9452f44a
- SHA1 02227dbe63a775fc29d6e4069722cc732db69211
- SHA512 526fc39da656c311aa9ac2ce5546222ebe110c7cced40c237d11973a85996bd26ca5b21942decf3c09ee60fe8c1234530ed17319b3201e0626558b0266ffe4fe
- SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7SAFcKoabbb4ZhM/RPIAEzjbogX3iFeQaeVXHGO2D:cu7e5TH2A2QSAvQZh6OAE3b/XS8teVRq
- TLSH
  T1AF232A003BE8C12BF2BE4F7899F26145867AB6633603D54A2CC4529B5713FC6D642AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2