asyncrat | 52f8d59fe4367e390b15444d85b751a03c84eb4374b6994648ca1c8afb95312d

Sharing

Copy URL Twitter E-mail

General

Target
52f8d59fe4367e390b15444d85b751a03c84eb4374b6994648ca1c8afb95312d
Size 45KB
Sample260720-jgc47acz7s
SHA256 52f8d59fe4367e390b15444d85b751a03c84eb4374b6994648ca1c8afb95312d
MD5 1ca38f7147c23a0796a7892162fb2650
SHA1 a5cd844ada3692a27d772728836f5637c729b9d7
SHA512 699f08a8f19722e6b988174513e92dd7033c479352c7ed6ca75c92f2489adfe5493dac4b79be42a7a95714d484188f413aa4d113d46c2cf18e5ae09a79a03747
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYJCHyTtUPIzzjb9gX3iDoEg/ik6XW8ckBDZ0x:8uuSpTgyf2Rnjz3bqXSDo4XWNSd0x
TLSH
T17A232C003BE9C12BF2BE4F78A9F26145857AF2673603D58A2CC4419B5723FC696426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

shokbazar.com:80
shokbazar.com:22
shokbazar.com:8080
shokbazar.com:8880
shokbazar.com:2052
shokbazar.com:2082
shokbazar.com:2086
shokbazar.com:2095
shokbazar.com:443
shokbazar.com:2053
shokbazar.com:2083
shokbazar.com:2087
shokbazar.com:2096
shokbazar.com:8443
www.shokbazar.com:80
www.shokbazar.com:22
www.shokbazar.com:8080
www.shokbazar.com:8880
www.shokbazar.com:2052
www.shokbazar.com:2082
www.shokbazar.com:2086
www.shokbazar.com:2095
www.shokbazar.com:443
www.shokbazar.com:2053
www.shokbazar.com:2083
www.shokbazar.com:2087
www.shokbazar.com:2096
www.shokbazar.com:8443
agenttesla.shokbazar.com:80
agenttesla.shokbazar.com:22
agenttesla.shokbazar.com:8080
agenttesla.shokbazar.com:8880
agenttesla.shokbazar.com:2052
agenttesla.shokbazar.com:2082
agenttesla.shokbazar.com:2086
agenttesla.shokbazar.com:2095
agenttesla.shokbazar.com:443
agenttesla.shokbazar.com:2053
agenttesla.shokbazar.com:2083
agenttesla.shokbazar.com:2087
agenttesla.shokbazar.com:2096
agenttesla.shokbazar.com:8443
invasive.shokbazar.com:80
invasive.shokbazar.com:22
invasive.shokbazar.com:8080
invasive.shokbazar.com:8880
invasive.shokbazar.com:2052
invasive.shokbazar.com:2082
invasive.shokbazar.com:2086
invasive.shokbazar.com:2095
invasive.shokbazar.com:443
invasive.shokbazar.com:2053
invasive.shokbazar.com:2083
invasive.shokbazar.com:2087
invasive.shokbazar.com:2096
invasive.shokbazar.com:8443
ryuk.shokbazar.com:80
ryuk.shokbazar.com:22
ryuk.shokbazar.com:8080
ryuk.shokbazar.com:8880
ryuk.shokbazar.com:2052
ryuk.shokbazar.com:2082
ryuk.shokbazar.com:2086
ryuk.shokbazar.com:2095
ryuk.shokbazar.com:443
ryuk.shokbazar.com:2053
ryuk.shokbazar.com:2083
ryuk.shokbazar.com:2087
ryuk.shokbazar.com:2096
ryuk.shokbazar.com:8443
rat.shokbazar.com:80
rat.shokbazar.com:22
rat.shokbazar.com:8080
rat.shokbazar.com:8880
rat.shokbazar.com:2052
rat.shokbazar.com:2082
rat.shokbazar.com:2086
rat.shokbazar.com:2095
rat.shokbazar.com:443
rat.shokbazar.com:2053
rat.shokbazar.com:2083
rat.shokbazar.com:2087
rat.shokbazar.com:2096
rat.shokbazar.com:8443

Mutex

f05SO7c3xztJ

Attributes

delay
0
install
true
install_file
up0o23.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  52f8d59fe4367e390b15444d85b751a03c84eb4374b6994648ca1c8afb95312d
- Size 45KB
- SHA256 52f8d59fe4367e390b15444d85b751a03c84eb4374b6994648ca1c8afb95312d
- MD5 1ca38f7147c23a0796a7892162fb2650
- SHA1 a5cd844ada3692a27d772728836f5637c729b9d7
- SHA512 699f08a8f19722e6b988174513e92dd7033c479352c7ed6ca75c92f2489adfe5493dac4b79be42a7a95714d484188f413aa4d113d46c2cf18e5ae09a79a03747
- SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYJCHyTtUPIzzjb9gX3iDoEg/ik6XW8ckBDZ0x:8uuSpTgyf2Rnjz3bqXSDo4XWNSd0x
- TLSH
  T17A232C003BE9C12BF2BE4F78A9F26145857AF2673603D58A2CC4419B5723FC696426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2