asyncrat | fb8b0c1bd39a57665cdf231ac50af773e368181cba23058afd0e0852a14222ee

Sharing

Copy URL Twitter E-mail

General

Target
fb8b0c1bd39a57665cdf231ac50af773e368181cba23058afd0e0852a14222ee
Size 45KB
Sample260720-vtd3ssa13y
SHA256 fb8b0c1bd39a57665cdf231ac50af773e368181cba23058afd0e0852a14222ee
MD5 53f76dadf764c022d2ac9d0e03630f48
SHA1 99ef13da99bee28db83fc1378b80316bc67910ec
SHA512 f80621d99dcb042cd177cb1f4f4e75a1dbed10abb41f156e1b667001b821291801e2e7899f5edc34042580ac5649483bdf09afa7132f4f4b09b10c32b9952fbc
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvsjbFgX3ikFlAbsJWF712U1kqitBDZEx:MuLAZTnbg2Z4EaHvcbCXSkAS0YU1kqQE
TLSH
T17F231B003BE8C127F2BE4F78ACF26145867AF6637603D54E2CC441975A13FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

flimora.top:80
flimora.top:22
flimora.top:8080
flimora.top:8880
flimora.top:2052
flimora.top:2082
flimora.top:2086
flimora.top:2095
flimora.top:443
flimora.top:2053
flimora.top:2083
flimora.top:2087
flimora.top:2096
flimora.top:8443
www.flimora.top:80
www.flimora.top:22
www.flimora.top:8080
www.flimora.top:8880
www.flimora.top:2052
www.flimora.top:2082
www.flimora.top:2086
www.flimora.top:2095
www.flimora.top:443
www.flimora.top:2053
www.flimora.top:2083
www.flimora.top:2087
www.flimora.top:2096
www.flimora.top:8443
darkside.flimora.top:80
darkside.flimora.top:22
darkside.flimora.top:8080
darkside.flimora.top:8880
darkside.flimora.top:2052
darkside.flimora.top:2082
darkside.flimora.top:2086
darkside.flimora.top:2095
darkside.flimora.top:443
darkside.flimora.top:2053
darkside.flimora.top:2083
darkside.flimora.top:2087
darkside.flimora.top:2096
darkside.flimora.top:8443
connect.flimora.top:80
connect.flimora.top:22
connect.flimora.top:8080
connect.flimora.top:8880
connect.flimora.top:2052
connect.flimora.top:2082
connect.flimora.top:2086
connect.flimora.top:2095
connect.flimora.top:443
connect.flimora.top:2053
connect.flimora.top:2083
connect.flimora.top:2087
connect.flimora.top:2096
connect.flimora.top:8443
revil.flimora.top:80
revil.flimora.top:22
revil.flimora.top:8080
revil.flimora.top:8880
revil.flimora.top:2052
revil.flimora.top:2082
revil.flimora.top:2086
revil.flimora.top:2095
revil.flimora.top:443
revil.flimora.top:2053
revil.flimora.top:2083
revil.flimora.top:2087
revil.flimora.top:2096
revil.flimora.top:8443
locky.flimora.top:80
locky.flimora.top:22
locky.flimora.top:8080
locky.flimora.top:8880
locky.flimora.top:2052
locky.flimora.top:2082
locky.flimora.top:2086
locky.flimora.top:2095
locky.flimora.top:443
locky.flimora.top:2053
locky.flimora.top:2083
locky.flimora.top:2087
locky.flimora.top:2096
locky.flimora.top:8443

Mutex

KSTxtEE2svnT

Attributes

delay
0
install
true
install_file
t4c68.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  fb8b0c1bd39a57665cdf231ac50af773e368181cba23058afd0e0852a14222ee
- Size 45KB
- SHA256 fb8b0c1bd39a57665cdf231ac50af773e368181cba23058afd0e0852a14222ee
- MD5 53f76dadf764c022d2ac9d0e03630f48
- SHA1 99ef13da99bee28db83fc1378b80316bc67910ec
- SHA512 f80621d99dcb042cd177cb1f4f4e75a1dbed10abb41f156e1b667001b821291801e2e7899f5edc34042580ac5649483bdf09afa7132f4f4b09b10c32b9952fbc
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvsjbFgX3ikFlAbsJWF712U1kqitBDZEx:MuLAZTnbg2Z4EaHvcbCXSkAS0YU1kqQE
- TLSH
  T17F231B003BE8C127F2BE4F78ACF26145867AF6637603D54E2CC441975A13FC69A426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2