asyncrat | 9fc27383452f6549c2406b0b856ff3197aad830a886c9850763dce054848af05

Sharing

Copy URL Twitter E-mail

General

Target
9fc27383452f6549c2406b0b856ff3197aad830a886c9850763dce054848af05
Size 45KB
Sample260720-lq4dvadw2m
SHA256 9fc27383452f6549c2406b0b856ff3197aad830a886c9850763dce054848af05
MD5 fa10c9f429ac3beb59862aa9e263dafb
SHA1 e8f6b15f19a3d7614dc1c8f20d0d3cf16e339455
SHA512 95c9043207d156715f452c78bd7e2271d986636afe7fef1b8787fc89a07b7b8e6926edc0d61360171aa53ac4a5a20db8745088613efd7f17234c39248445a2d9
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1mGsGx8OHuPI2zjbxgw3i4Dql1GZab4sMihbvUB0:cu6YepTPso2rez323b+wSnuWhbKdUx
TLSH
T18C232B003BE9822BF2BE4FB498F26145467AF6637603D64D1CC451DB5623FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

shokbazar.com:80
shokbazar.com:22
shokbazar.com:8080
shokbazar.com:8880
shokbazar.com:2052
shokbazar.com:2082
shokbazar.com:2086
shokbazar.com:2095
shokbazar.com:443
shokbazar.com:2053
shokbazar.com:2083
shokbazar.com:2087
shokbazar.com:2096
shokbazar.com:8443
www.shokbazar.com:80
www.shokbazar.com:22
www.shokbazar.com:8080
www.shokbazar.com:8880
www.shokbazar.com:2052
www.shokbazar.com:2082
www.shokbazar.com:2086
www.shokbazar.com:2095
www.shokbazar.com:443
www.shokbazar.com:2053
www.shokbazar.com:2083
www.shokbazar.com:2087
www.shokbazar.com:2096
www.shokbazar.com:8443
sodinokibi.shokbazar.com:80
sodinokibi.shokbazar.com:22
sodinokibi.shokbazar.com:8080
sodinokibi.shokbazar.com:8880
sodinokibi.shokbazar.com:2052
sodinokibi.shokbazar.com:2082
sodinokibi.shokbazar.com:2086
sodinokibi.shokbazar.com:2095
sodinokibi.shokbazar.com:443
sodinokibi.shokbazar.com:2053
sodinokibi.shokbazar.com:2083
sodinokibi.shokbazar.com:2087
sodinokibi.shokbazar.com:2096
sodinokibi.shokbazar.com:8443
sasser.shokbazar.com:80
sasser.shokbazar.com:22
sasser.shokbazar.com:8080
sasser.shokbazar.com:8880
sasser.shokbazar.com:2052
sasser.shokbazar.com:2082
sasser.shokbazar.com:2086
sasser.shokbazar.com:2095
sasser.shokbazar.com:443
sasser.shokbazar.com:2053
sasser.shokbazar.com:2083
sasser.shokbazar.com:2087
sasser.shokbazar.com:2096
sasser.shokbazar.com:8443
blaster.shokbazar.com:80
blaster.shokbazar.com:22
blaster.shokbazar.com:8080
blaster.shokbazar.com:8880
blaster.shokbazar.com:2052
blaster.shokbazar.com:2082
blaster.shokbazar.com:2086
blaster.shokbazar.com:2095
blaster.shokbazar.com:443
blaster.shokbazar.com:2053
blaster.shokbazar.com:2083
blaster.shokbazar.com:2087
blaster.shokbazar.com:2096
blaster.shokbazar.com:8443

Mutex

UGqBpNisy5dL

Attributes

delay
0
install
true
install_file
5od9mw4h.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  9fc27383452f6549c2406b0b856ff3197aad830a886c9850763dce054848af05
- Size 45KB
- SHA256 9fc27383452f6549c2406b0b856ff3197aad830a886c9850763dce054848af05
- MD5 fa10c9f429ac3beb59862aa9e263dafb
- SHA1 e8f6b15f19a3d7614dc1c8f20d0d3cf16e339455
- SHA512 95c9043207d156715f452c78bd7e2271d986636afe7fef1b8787fc89a07b7b8e6926edc0d61360171aa53ac4a5a20db8745088613efd7f17234c39248445a2d9
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1mGsGx8OHuPI2zjbxgw3i4Dql1GZab4sMihbvUB0:cu6YepTPso2rez323b+wSnuWhbKdUx
- TLSH
  T18C232B003BE9822BF2BE4FB498F26145467AF6637603D64D1CC451DB5623FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2