asyncrat | 078a2aa4e911a90d865ece5eda494476180ae1f4d7d302464919630fc00d93bf

Sharing

Copy URL Twitter E-mail

General

Target
078a2aa4e911a90d865ece5eda494476180ae1f4d7d302464919630fc00d93bf
Size 45KB
Sample260720-mk32kaey7j
SHA256 078a2aa4e911a90d865ece5eda494476180ae1f4d7d302464919630fc00d93bf
MD5 8005c7cad8af9a68c36daaa99ea024cb
SHA1 b97a5131453a5b819f577d2cc788ada0f0f854c2
SHA512 03afef00389d1bf330ab490a3d5e5b16e5b32b5fbcbdf982dab97efed5b0b6c5adba590f78a134715b34bf76c5f61fb2aab353831509841819970df8c25c2a65
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwi3xK6yZoOPItzjbfgW3iNuWFIkugKT9JBBDZMx:ku40ZTXEb2ecPo3t3boWSNgkugKT/dMx
TLSH
T13F232A003BE8822BF2BE4F78ADF26145467AF6732603D68D1CC451DB4613BC696526EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

shokbazar.com:80
shokbazar.com:22
shokbazar.com:8080
shokbazar.com:8880
shokbazar.com:2052
shokbazar.com:2082
shokbazar.com:2086
shokbazar.com:2095
shokbazar.com:443
shokbazar.com:2053
shokbazar.com:2083
shokbazar.com:2087
shokbazar.com:2096
shokbazar.com:8443
www.shokbazar.com:80
www.shokbazar.com:22
www.shokbazar.com:8080
www.shokbazar.com:8880
www.shokbazar.com:2052
www.shokbazar.com:2082
www.shokbazar.com:2086
www.shokbazar.com:2095
www.shokbazar.com:443
www.shokbazar.com:2053
www.shokbazar.com:2083
www.shokbazar.com:2087
www.shokbazar.com:2096
www.shokbazar.com:8443
fakeupdates.shokbazar.com:80
fakeupdates.shokbazar.com:22
fakeupdates.shokbazar.com:8080
fakeupdates.shokbazar.com:8880
fakeupdates.shokbazar.com:2052
fakeupdates.shokbazar.com:2082
fakeupdates.shokbazar.com:2086
fakeupdates.shokbazar.com:2095
fakeupdates.shokbazar.com:443
fakeupdates.shokbazar.com:2053
fakeupdates.shokbazar.com:2083
fakeupdates.shokbazar.com:2087
fakeupdates.shokbazar.com:2096
fakeupdates.shokbazar.com:8443
malware.shokbazar.com:80
malware.shokbazar.com:22
malware.shokbazar.com:8080
malware.shokbazar.com:8880
malware.shokbazar.com:2052
malware.shokbazar.com:2082
malware.shokbazar.com:2086
malware.shokbazar.com:2095
malware.shokbazar.com:443
malware.shokbazar.com:2053
malware.shokbazar.com:2083
malware.shokbazar.com:2087
malware.shokbazar.com:2096
malware.shokbazar.com:8443
qakbot.shokbazar.com:80
qakbot.shokbazar.com:22
qakbot.shokbazar.com:8080
qakbot.shokbazar.com:8880
qakbot.shokbazar.com:2052
qakbot.shokbazar.com:2082
qakbot.shokbazar.com:2086
qakbot.shokbazar.com:2095
qakbot.shokbazar.com:443
qakbot.shokbazar.com:2053
qakbot.shokbazar.com:2083
qakbot.shokbazar.com:2087
qakbot.shokbazar.com:2096
qakbot.shokbazar.com:8443
hacker.shokbazar.com:80
hacker.shokbazar.com:22
hacker.shokbazar.com:8080
hacker.shokbazar.com:8880
hacker.shokbazar.com:2052
hacker.shokbazar.com:2082
hacker.shokbazar.com:2086
hacker.shokbazar.com:2095
hacker.shokbazar.com:443
hacker.shokbazar.com:2053
hacker.shokbazar.com:2083
hacker.shokbazar.com:2087
hacker.shokbazar.com:2096
hacker.shokbazar.com:8443

Mutex

ERGKUl2eYhDI

Attributes

delay
0
install
true
install_file
zzxtk.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  078a2aa4e911a90d865ece5eda494476180ae1f4d7d302464919630fc00d93bf
- Size 45KB
- SHA256 078a2aa4e911a90d865ece5eda494476180ae1f4d7d302464919630fc00d93bf
- MD5 8005c7cad8af9a68c36daaa99ea024cb
- SHA1 b97a5131453a5b819f577d2cc788ada0f0f854c2
- SHA512 03afef00389d1bf330ab490a3d5e5b16e5b32b5fbcbdf982dab97efed5b0b6c5adba590f78a134715b34bf76c5f61fb2aab353831509841819970df8c25c2a65
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwi3xK6yZoOPItzjbfgW3iNuWFIkugKT9JBBDZMx:ku40ZTXEb2ecPo3t3boWSNgkugKT/dMx
- TLSH
  T13F232A003BE8822BF2BE4F78ADF26145467AF6732603D68D1CC451DB4613BC696526EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2