asyncrat | 392c56a1afc85bd44cd3d8c05fcc4d26b0e81350541d22ef683ef1119628ea99

Sharing

Copy URL Twitter E-mail

General

Target
392c56a1afc85bd44cd3d8c05fcc4d26b0e81350541d22ef683ef1119628ea99
Size 45KB
Sample260720-lyltrsgv7v
SHA256 392c56a1afc85bd44cd3d8c05fcc4d26b0e81350541d22ef683ef1119628ea99
MD5 e078b126d11a93c0c86de3c4ee6072c3
SHA1 d4f5f7e78a4cf767e813b5bd1335d9c51374cb9c
SHA512 a02d35b227464e718c443fd82606d4f403588c35cad182b0ac875fe58fbc121b89fe626a3ebd5ad717f810b21a4f5cc9c909178055aac000060101ecc0f34d85
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4ziDUynzWOPIazjb8gXHiUxmy25NUIAA7mQclBDZ2:8uUIpT4vAj23iYp3a3bTXCUcpg1A7Fc4
TLSH
T10C231B003BE9812BF2BE5F7898F26145867EB6633603D54A1CC452D75723FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

shokbazar.com:80
shokbazar.com:22
shokbazar.com:8080
shokbazar.com:8880
shokbazar.com:2052
shokbazar.com:2082
shokbazar.com:2086
shokbazar.com:2095
shokbazar.com:443
shokbazar.com:2053
shokbazar.com:2083
shokbazar.com:2087
shokbazar.com:2096
shokbazar.com:8443
www.shokbazar.com:80
www.shokbazar.com:22
www.shokbazar.com:8080
www.shokbazar.com:8880
www.shokbazar.com:2052
www.shokbazar.com:2082
www.shokbazar.com:2086
www.shokbazar.com:2095
www.shokbazar.com:443
www.shokbazar.com:2053
www.shokbazar.com:2083
www.shokbazar.com:2087
www.shokbazar.com:2096
www.shokbazar.com:8443
formbook.shokbazar.com:80
formbook.shokbazar.com:22
formbook.shokbazar.com:8080
formbook.shokbazar.com:8880
formbook.shokbazar.com:2052
formbook.shokbazar.com:2082
formbook.shokbazar.com:2086
formbook.shokbazar.com:2095
formbook.shokbazar.com:443
formbook.shokbazar.com:2053
formbook.shokbazar.com:2083
formbook.shokbazar.com:2087
formbook.shokbazar.com:2096
formbook.shokbazar.com:8443
azorult.shokbazar.com:80
azorult.shokbazar.com:22
azorult.shokbazar.com:8080
azorult.shokbazar.com:8880
azorult.shokbazar.com:2052
azorult.shokbazar.com:2082
azorult.shokbazar.com:2086
azorult.shokbazar.com:2095
azorult.shokbazar.com:443
azorult.shokbazar.com:2053
azorult.shokbazar.com:2083
azorult.shokbazar.com:2087
azorult.shokbazar.com:2096
azorult.shokbazar.com:8443
socgholish.shokbazar.com:80
socgholish.shokbazar.com:22
socgholish.shokbazar.com:8080
socgholish.shokbazar.com:8880
socgholish.shokbazar.com:2052
socgholish.shokbazar.com:2082
socgholish.shokbazar.com:2086
socgholish.shokbazar.com:2095
socgholish.shokbazar.com:443
socgholish.shokbazar.com:2053
socgholish.shokbazar.com:2083
socgholish.shokbazar.com:2087
socgholish.shokbazar.com:2096
socgholish.shokbazar.com:8443
sasser.shokbazar.com:80
sasser.shokbazar.com:22
sasser.shokbazar.com:8080
sasser.shokbazar.com:8880
sasser.shokbazar.com:2052
sasser.shokbazar.com:2082
sasser.shokbazar.com:2086
sasser.shokbazar.com:2095
sasser.shokbazar.com:443
sasser.shokbazar.com:2053
sasser.shokbazar.com:2083
sasser.shokbazar.com:2087
sasser.shokbazar.com:2096
sasser.shokbazar.com:8443

Mutex

hxBcdAf9MOUB

Attributes

delay
0
install
true
install_file
wg3rtcr.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  392c56a1afc85bd44cd3d8c05fcc4d26b0e81350541d22ef683ef1119628ea99
- Size 45KB
- SHA256 392c56a1afc85bd44cd3d8c05fcc4d26b0e81350541d22ef683ef1119628ea99
- MD5 e078b126d11a93c0c86de3c4ee6072c3
- SHA1 d4f5f7e78a4cf767e813b5bd1335d9c51374cb9c
- SHA512 a02d35b227464e718c443fd82606d4f403588c35cad182b0ac875fe58fbc121b89fe626a3ebd5ad717f810b21a4f5cc9c909178055aac000060101ecc0f34d85
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4ziDUynzWOPIazjb8gXHiUxmy25NUIAA7mQclBDZ2:8uUIpT4vAj23iYp3a3bTXCUcpg1A7Fc4
- TLSH
  T10C231B003BE9812BF2BE5F7898F26145867EB6633603D54A1CC452D75723FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2