asyncrat | 16dedfa44f1a93a1dc199f2acbc937e6c318fe00037df05392fd5a6d83185971

Sharing

Copy URL Twitter E-mail

General

Target
16dedfa44f1a93a1dc199f2acbc937e6c318fe00037df05392fd5a6d83185971
Size 45KB
Sample260721-rf1g4axeqf
SHA256 16dedfa44f1a93a1dc199f2acbc937e6c318fe00037df05392fd5a6d83185971
MD5 23ff2d1c72fd7a1913dbdb2908f5592e
SHA1 93c1bb349cfe57826607fe0faed74ef1703efd96
SHA512 485ac5598a1cd5ebb386093d04aeafb81852f6d8b9e85d59581b3415a40e63493e16f54c977a7513d7d22c45b3151901b8a1ba0b4d9976922be30898cb5110e0
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIM1jb2gX3iu7SiUV2Hb5ayd0Mm:MuBGJTPho2Q/CFWBMdbpXSh5UHhdBdEx
TLSH
T16C232A0037E9812BF2BE4F7869F26245867BF5737603D64A1CC441DB5A23FC58A42AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

flimora.top:80
flimora.top:22
flimora.top:8080
flimora.top:8880
flimora.top:2052
flimora.top:2082
flimora.top:2086
flimora.top:2095
flimora.top:443
flimora.top:2053
flimora.top:2083
flimora.top:2087
flimora.top:2096
flimora.top:8443
www.flimora.top:80
www.flimora.top:22
www.flimora.top:8080
www.flimora.top:8880
www.flimora.top:2052
www.flimora.top:2082
www.flimora.top:2086
www.flimora.top:2095
www.flimora.top:443
www.flimora.top:2053
www.flimora.top:2083
www.flimora.top:2087
www.flimora.top:2096
www.flimora.top:8443
zbot.flimora.top:80
zbot.flimora.top:22
zbot.flimora.top:8080
zbot.flimora.top:8880
zbot.flimora.top:2052
zbot.flimora.top:2082
zbot.flimora.top:2086
zbot.flimora.top:2095
zbot.flimora.top:443
zbot.flimora.top:2053
zbot.flimora.top:2083
zbot.flimora.top:2087
zbot.flimora.top:2096
zbot.flimora.top:8443
gootloader.flimora.top:80
gootloader.flimora.top:22
gootloader.flimora.top:8080
gootloader.flimora.top:8880
gootloader.flimora.top:2052
gootloader.flimora.top:2082
gootloader.flimora.top:2086
gootloader.flimora.top:2095
gootloader.flimora.top:443
gootloader.flimora.top:2053
gootloader.flimora.top:2083
gootloader.flimora.top:2087
gootloader.flimora.top:2096
gootloader.flimora.top:8443
stuxnet.flimora.top:80
stuxnet.flimora.top:22
stuxnet.flimora.top:8080
stuxnet.flimora.top:8880
stuxnet.flimora.top:2052
stuxnet.flimora.top:2082
stuxnet.flimora.top:2086
stuxnet.flimora.top:2095
stuxnet.flimora.top:443
stuxnet.flimora.top:2053
stuxnet.flimora.top:2083
stuxnet.flimora.top:2087
stuxnet.flimora.top:2096
stuxnet.flimora.top:8443
shamoon.flimora.top:80
shamoon.flimora.top:22
shamoon.flimora.top:8080
shamoon.flimora.top:8880
shamoon.flimora.top:2052
shamoon.flimora.top:2082
shamoon.flimora.top:2086
shamoon.flimora.top:2095
shamoon.flimora.top:443
shamoon.flimora.top:2053
shamoon.flimora.top:2083
shamoon.flimora.top:2087
shamoon.flimora.top:2096
shamoon.flimora.top:8443

Mutex

dbLsxrabYK8n

Attributes

delay
0
install
true
install_file
o14b.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  16dedfa44f1a93a1dc199f2acbc937e6c318fe00037df05392fd5a6d83185971
- Size 45KB
- SHA256 16dedfa44f1a93a1dc199f2acbc937e6c318fe00037df05392fd5a6d83185971
- MD5 23ff2d1c72fd7a1913dbdb2908f5592e
- SHA1 93c1bb349cfe57826607fe0faed74ef1703efd96
- SHA512 485ac5598a1cd5ebb386093d04aeafb81852f6d8b9e85d59581b3415a40e63493e16f54c977a7513d7d22c45b3151901b8a1ba0b4d9976922be30898cb5110e0
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIM1jb2gX3iu7SiUV2Hb5ayd0Mm:MuBGJTPho2Q/CFWBMdbpXSh5UHhdBdEx
- TLSH
  T16C232A0037E9812BF2BE4F7869F26245867BF5737603D64A1CC441DB5A23FC58A42AF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2