asyncrat | 36d4ab8631a3b0814fd75ecc284afd2db2203700e3452ba8b738109a984e9069

Sharing

Copy URL Twitter E-mail

General

Target
36d4ab8631a3b0814fd75ecc284afd2db2203700e3452ba8b738109a984e9069
Size 45KB
Sample260718-t6493sa15w
SHA256 36d4ab8631a3b0814fd75ecc284afd2db2203700e3452ba8b738109a984e9069
MD5 5f3b1407d068d254dd2416db9e8c4834
SHA1 7cad7581b0b4eca9cc3a4402284c0427eb906a45
SHA512 48177988f82928d81954377e882520842050f9404d479d71d4bd214a122102e868e2797458bfa12f0780dfbae4b30cace406801b278c8448aa71ac13f2f1cd5d
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9D9Y6kq/zNOPIyzjblga3i1DCKoJBkhDSV1Iu7VHBc:EufspTf2g2Oa9C3y3biaSZTeBNBhdsx
TLSH
T1982319003BE9C12BF2BE5F7898F26145867EF2633603D64A1CC451DB5613BC69A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chichgai.one:80
chichgai.one:22
chichgai.one:8080
chichgai.one:8880
chichgai.one:2052
chichgai.one:2082
chichgai.one:2086
chichgai.one:2095
chichgai.one:443
chichgai.one:2053
chichgai.one:2083
chichgai.one:2087
chichgai.one:2096
chichgai.one:8443
www.chichgai.one:80
www.chichgai.one:22
www.chichgai.one:8080
www.chichgai.one:8880
www.chichgai.one:2052
www.chichgai.one:2082
www.chichgai.one:2086
www.chichgai.one:2095
www.chichgai.one:443
www.chichgai.one:2053
www.chichgai.one:2083
www.chichgai.one:2087
www.chichgai.one:2096
www.chichgai.one:8443
shamoon.chichgai.one:80
shamoon.chichgai.one:22
shamoon.chichgai.one:8080
shamoon.chichgai.one:8880
shamoon.chichgai.one:2052
shamoon.chichgai.one:2082
shamoon.chichgai.one:2086
shamoon.chichgai.one:2095
shamoon.chichgai.one:443
shamoon.chichgai.one:2053
shamoon.chichgai.one:2083
shamoon.chichgai.one:2087
shamoon.chichgai.one:2096
shamoon.chichgai.one:8443
sasser.chichgai.one:80
sasser.chichgai.one:22
sasser.chichgai.one:8080
sasser.chichgai.one:8880
sasser.chichgai.one:2052
sasser.chichgai.one:2082
sasser.chichgai.one:2086
sasser.chichgai.one:2095
sasser.chichgai.one:443
sasser.chichgai.one:2053
sasser.chichgai.one:2083
sasser.chichgai.one:2087
sasser.chichgai.one:2096
sasser.chichgai.one:8443
gozi.chichgai.one:80
gozi.chichgai.one:22
gozi.chichgai.one:8080
gozi.chichgai.one:8880
gozi.chichgai.one:2052
gozi.chichgai.one:2082
gozi.chichgai.one:2086
gozi.chichgai.one:2095
gozi.chichgai.one:443
gozi.chichgai.one:2053
gozi.chichgai.one:2083
gozi.chichgai.one:2087
gozi.chichgai.one:2096
gozi.chichgai.one:8443
dridex.chichgai.one:80
dridex.chichgai.one:22
dridex.chichgai.one:8080
dridex.chichgai.one:8880
dridex.chichgai.one:2052
dridex.chichgai.one:2082
dridex.chichgai.one:2086
dridex.chichgai.one:2095
dridex.chichgai.one:443
dridex.chichgai.one:2053
dridex.chichgai.one:2083
dridex.chichgai.one:2087
dridex.chichgai.one:2096
dridex.chichgai.one:8443

Mutex

6P6DJ4J83NAF

Attributes

delay
0
install
true
install_file
57q06qi.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  36d4ab8631a3b0814fd75ecc284afd2db2203700e3452ba8b738109a984e9069
- Size 45KB
- SHA256 36d4ab8631a3b0814fd75ecc284afd2db2203700e3452ba8b738109a984e9069
- MD5 5f3b1407d068d254dd2416db9e8c4834
- SHA1 7cad7581b0b4eca9cc3a4402284c0427eb906a45
- SHA512 48177988f82928d81954377e882520842050f9404d479d71d4bd214a122102e868e2797458bfa12f0780dfbae4b30cace406801b278c8448aa71ac13f2f1cd5d
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9D9Y6kq/zNOPIyzjblga3i1DCKoJBkhDSV1Iu7VHBc:EufspTf2g2Oa9C3y3biaSZTeBNBhdsx
- TLSH
  T1982319003BE9C12BF2BE5F7898F26145867EF2633603D64A1CC451DB5613BC69A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2