asyncrat | 7435a6ade00585ce4d23de449d289600dcfe2ccc5889eded7adcc33f86ad45b5

Sharing

Copy URL Twitter E-mail

General

Target
7435a6ade00585ce4d23de449d289600dcfe2ccc5889eded7adcc33f86ad45b5
Size 45KB
Sample260720-lstbnags7w
SHA256 7435a6ade00585ce4d23de449d289600dcfe2ccc5889eded7adcc33f86ad45b5
MD5 dd2ffccd33fe3a3e6945daafe9c89beb
SHA1 bf05379c5350b2245b1646ff622fdbefdfb40f67
SHA512 0d8806fafd622cc582374902e175b0b418f5f447a249ef66f955c120a7bd7042ad71d9088720d36328a58b1a414207047f700428cfcf01ab9da34cb5b0c98f68
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBOjTOPI/Tzjb9BgX3iLX5XBpidAV3BDZsx:EulCJTHl42IyYf3/T3bYXSF6d4xdsx
TLSH
T131230A003BE8812BF2BE5F78ACF26145867AF6633603D54A1CC451DB5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

shokbazar.com:80
shokbazar.com:22
shokbazar.com:8080
shokbazar.com:8880
shokbazar.com:2052
shokbazar.com:2082
shokbazar.com:2086
shokbazar.com:2095
shokbazar.com:443
shokbazar.com:2053
shokbazar.com:2083
shokbazar.com:2087
shokbazar.com:2096
shokbazar.com:8443
www.shokbazar.com:80
www.shokbazar.com:22
www.shokbazar.com:8080
www.shokbazar.com:8880
www.shokbazar.com:2052
www.shokbazar.com:2082
www.shokbazar.com:2086
www.shokbazar.com:2095
www.shokbazar.com:443
www.shokbazar.com:2053
www.shokbazar.com:2083
www.shokbazar.com:2087
www.shokbazar.com:2096
www.shokbazar.com:8443
invasive.shokbazar.com:80
invasive.shokbazar.com:22
invasive.shokbazar.com:8080
invasive.shokbazar.com:8880
invasive.shokbazar.com:2052
invasive.shokbazar.com:2082
invasive.shokbazar.com:2086
invasive.shokbazar.com:2095
invasive.shokbazar.com:443
invasive.shokbazar.com:2053
invasive.shokbazar.com:2083
invasive.shokbazar.com:2087
invasive.shokbazar.com:2096
invasive.shokbazar.com:8443
gh0st.shokbazar.com:80
gh0st.shokbazar.com:22
gh0st.shokbazar.com:8080
gh0st.shokbazar.com:8880
gh0st.shokbazar.com:2052
gh0st.shokbazar.com:2082
gh0st.shokbazar.com:2086
gh0st.shokbazar.com:2095
gh0st.shokbazar.com:443
gh0st.shokbazar.com:2053
gh0st.shokbazar.com:2083
gh0st.shokbazar.com:2087
gh0st.shokbazar.com:2096
gh0st.shokbazar.com:8443
azorult.shokbazar.com:80
azorult.shokbazar.com:22
azorult.shokbazar.com:8080
azorult.shokbazar.com:8880
azorult.shokbazar.com:2052
azorult.shokbazar.com:2082
azorult.shokbazar.com:2086
azorult.shokbazar.com:2095
azorult.shokbazar.com:443
azorult.shokbazar.com:2053
azorult.shokbazar.com:2083
azorult.shokbazar.com:2087
azorult.shokbazar.com:2096
azorult.shokbazar.com:8443

Mutex

JJKUHiZ10IyE

Attributes

delay
0
install
true
install_file
vqb2dx.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  7435a6ade00585ce4d23de449d289600dcfe2ccc5889eded7adcc33f86ad45b5
- Size 45KB
- SHA256 7435a6ade00585ce4d23de449d289600dcfe2ccc5889eded7adcc33f86ad45b5
- MD5 dd2ffccd33fe3a3e6945daafe9c89beb
- SHA1 bf05379c5350b2245b1646ff622fdbefdfb40f67
- SHA512 0d8806fafd622cc582374902e175b0b418f5f447a249ef66f955c120a7bd7042ad71d9088720d36328a58b1a414207047f700428cfcf01ab9da34cb5b0c98f68
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBOjTOPI/Tzjb9BgX3iLX5XBpidAV3BDZsx:EulCJTHl42IyYf3/T3bYXSF6d4xdsx
- TLSH
  T131230A003BE8812BF2BE5F78ACF26145867AF6633603D54A1CC451DB5613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2