asyncrat | 15fa8ef91dccb52c6b871112592990a2e30113efd84b61cd24c51ec3bd527377

Sharing

Copy URL Twitter E-mail

General

Target
15fa8ef91dccb52c6b871112592990a2e30113efd84b61cd24c51ec3bd527377
Size 45KB
Sample260720-ly58eagv9v
SHA256 15fa8ef91dccb52c6b871112592990a2e30113efd84b61cd24c51ec3bd527377
MD5 d4fcb32019295cae668ea4002f5b2eb5
SHA1 bb23aa18cf53a4e370d8c97e116d49a0c58b4ba5
SHA512 db3a772deba930b3ff9af67329d8258cdf5749751daf85c90de52bd526545bf63b62af1f6cca1407f40c959c78b75a000645cc7c60e2b364c6d7c7cd976f6a89
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCM+d4CvS8PIkCjblgX3iydNAt1RI/oNwwu0Pu:kuSOpTPOP2x/CFWBkObiXSy3wwU5dMx
TLSH
T118232B0037E9822BF2BE4F74A9F25145867BF6632603D54E1C8451DB5A23FC68A436FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

shokbazar.com:80
shokbazar.com:22
shokbazar.com:8080
shokbazar.com:8880
shokbazar.com:2052
shokbazar.com:2082
shokbazar.com:2086
shokbazar.com:2095
shokbazar.com:443
shokbazar.com:2053
shokbazar.com:2083
shokbazar.com:2087
shokbazar.com:2096
shokbazar.com:8443
www.shokbazar.com:80
www.shokbazar.com:22
www.shokbazar.com:8080
www.shokbazar.com:8880
www.shokbazar.com:2052
www.shokbazar.com:2082
www.shokbazar.com:2086
www.shokbazar.com:2095
www.shokbazar.com:443
www.shokbazar.com:2053
www.shokbazar.com:2083
www.shokbazar.com:2087
www.shokbazar.com:2096
www.shokbazar.com:8443
fakeupdates.shokbazar.com:80
fakeupdates.shokbazar.com:22
fakeupdates.shokbazar.com:8080
fakeupdates.shokbazar.com:8880
fakeupdates.shokbazar.com:2052
fakeupdates.shokbazar.com:2082
fakeupdates.shokbazar.com:2086
fakeupdates.shokbazar.com:2095
fakeupdates.shokbazar.com:443
fakeupdates.shokbazar.com:2053
fakeupdates.shokbazar.com:2083
fakeupdates.shokbazar.com:2087
fakeupdates.shokbazar.com:2096
fakeupdates.shokbazar.com:8443
trisis.shokbazar.com:80
trisis.shokbazar.com:22
trisis.shokbazar.com:8080
trisis.shokbazar.com:8880
trisis.shokbazar.com:2052
trisis.shokbazar.com:2082
trisis.shokbazar.com:2086
trisis.shokbazar.com:2095
trisis.shokbazar.com:443
trisis.shokbazar.com:2053
trisis.shokbazar.com:2083
trisis.shokbazar.com:2087
trisis.shokbazar.com:2096
trisis.shokbazar.com:8443
shamoon.shokbazar.com:80
shamoon.shokbazar.com:22
shamoon.shokbazar.com:8080
shamoon.shokbazar.com:8880
shamoon.shokbazar.com:2052
shamoon.shokbazar.com:2082
shamoon.shokbazar.com:2086
shamoon.shokbazar.com:2095
shamoon.shokbazar.com:443
shamoon.shokbazar.com:2053
shamoon.shokbazar.com:2083
shamoon.shokbazar.com:2087
shamoon.shokbazar.com:2096
shamoon.shokbazar.com:8443
zbot.shokbazar.com:80
zbot.shokbazar.com:22
zbot.shokbazar.com:8080
zbot.shokbazar.com:8880
zbot.shokbazar.com:2052
zbot.shokbazar.com:2082
zbot.shokbazar.com:2086
zbot.shokbazar.com:2095
zbot.shokbazar.com:443
zbot.shokbazar.com:2053
zbot.shokbazar.com:2083
zbot.shokbazar.com:2087
zbot.shokbazar.com:2096
zbot.shokbazar.com:8443

Mutex

20b4wBRLDMMb

Attributes

delay
0
install
true
install_file
4m1c.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  15fa8ef91dccb52c6b871112592990a2e30113efd84b61cd24c51ec3bd527377
- Size 45KB
- SHA256 15fa8ef91dccb52c6b871112592990a2e30113efd84b61cd24c51ec3bd527377
- MD5 d4fcb32019295cae668ea4002f5b2eb5
- SHA1 bb23aa18cf53a4e370d8c97e116d49a0c58b4ba5
- SHA512 db3a772deba930b3ff9af67329d8258cdf5749751daf85c90de52bd526545bf63b62af1f6cca1407f40c959c78b75a000645cc7c60e2b364c6d7c7cd976f6a89
- SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCM+d4CvS8PIkCjblgX3iydNAt1RI/oNwwu0Pu:kuSOpTPOP2x/CFWBkObiXSy3wwU5dMx
- TLSH
  T118232B0037E9822BF2BE4F74A9F25145867BF6632603D54E1C8451DB5A23FC68A436FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2