asyncrat | 10b48dc5300c69a2e5c8fe460841f6b382cb812cb5401edb66c6a2fc67c437cb

Sharing

Copy URL Twitter E-mail

General

Target
10b48dc5300c69a2e5c8fe460841f6b382cb812cb5401edb66c6a2fc67c437cb
Size 45KB
Sample260718-nrjryadt7s
SHA256 10b48dc5300c69a2e5c8fe460841f6b382cb812cb5401edb66c6a2fc67c437cb
MD5 f106466705686b638bb958ef5c508f7f
SHA1 bf0dc389a7e7a6971dc57659e16bb9be121a69cf
SHA512 c94bf1e2d43a4b7b37801ad2b5ff3d5bd342e71bb0d2187169da902b835dd741014be90262cfdedcda8bfdf120cce6ad0eb80176b7688816aaf969f20e72c20f
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zITnyfaaPIYzjb9gX3ihXYlnpusYfhc9lHBDZ8x:0uPrpT/qY2QEhY3bqXShXYLus19lhd8x
TLSH
T14E233C003BE9C12BF2BF5F789DF26145457AF5632A03D6891CC4119B1623FC68A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

clxx.com:80
clxx.com:22
clxx.com:8080
clxx.com:8880
clxx.com:2052
clxx.com:2082
clxx.com:2086
clxx.com:2095
clxx.com:443
clxx.com:2053
clxx.com:2083
clxx.com:2087
clxx.com:2096
clxx.com:8443
www.clxx.com:80
www.clxx.com:22
www.clxx.com:8080
www.clxx.com:8880
www.clxx.com:2052
www.clxx.com:2082
www.clxx.com:2086
www.clxx.com:2095
www.clxx.com:443
www.clxx.com:2053
www.clxx.com:2083
www.clxx.com:2087
www.clxx.com:2096
www.clxx.com:8443
remcos.clxx.com:80
remcos.clxx.com:22
remcos.clxx.com:8080
remcos.clxx.com:8880
remcos.clxx.com:2052
remcos.clxx.com:2082
remcos.clxx.com:2086
remcos.clxx.com:2095
remcos.clxx.com:443
remcos.clxx.com:2053
remcos.clxx.com:2083
remcos.clxx.com:2087
remcos.clxx.com:2096
remcos.clxx.com:8443
gh0st.clxx.com:80
gh0st.clxx.com:22
gh0st.clxx.com:8080
gh0st.clxx.com:8880
gh0st.clxx.com:2052
gh0st.clxx.com:2082
gh0st.clxx.com:2086
gh0st.clxx.com:2095
gh0st.clxx.com:443
gh0st.clxx.com:2053
gh0st.clxx.com:2083
gh0st.clxx.com:2087
gh0st.clxx.com:2096
gh0st.clxx.com:8443
agenttesla.clxx.com:80
agenttesla.clxx.com:22
agenttesla.clxx.com:8080
agenttesla.clxx.com:8880
agenttesla.clxx.com:2052
agenttesla.clxx.com:2082
agenttesla.clxx.com:2086
agenttesla.clxx.com:2095
agenttesla.clxx.com:443
agenttesla.clxx.com:2053
agenttesla.clxx.com:2083
agenttesla.clxx.com:2087
agenttesla.clxx.com:2096
agenttesla.clxx.com:8443
klez.clxx.com:80
klez.clxx.com:22
klez.clxx.com:8080
klez.clxx.com:8880
klez.clxx.com:2052
klez.clxx.com:2082
klez.clxx.com:2086
klez.clxx.com:2095
klez.clxx.com:443
klez.clxx.com:2053
klez.clxx.com:2083
klez.clxx.com:2087
klez.clxx.com:2096
klez.clxx.com:8443

Mutex

fPTkkgg2EK8F

Attributes

delay
0
install
true
install_file
fo8yq93.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  10b48dc5300c69a2e5c8fe460841f6b382cb812cb5401edb66c6a2fc67c437cb
- Size 45KB
- SHA256 10b48dc5300c69a2e5c8fe460841f6b382cb812cb5401edb66c6a2fc67c437cb
- MD5 f106466705686b638bb958ef5c508f7f
- SHA1 bf0dc389a7e7a6971dc57659e16bb9be121a69cf
- SHA512 c94bf1e2d43a4b7b37801ad2b5ff3d5bd342e71bb0d2187169da902b835dd741014be90262cfdedcda8bfdf120cce6ad0eb80176b7688816aaf969f20e72c20f
- SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zITnyfaaPIYzjb9gX3ihXYlnpusYfhc9lHBDZ8x:0uPrpT/qY2QEhY3bqXShXYLus19lhd8x
- TLSH
  T14E233C003BE9C12BF2BF5F789DF26145457AF5632A03D6891CC4119B1623FC68A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2