asyncrat | 0e63de6cf4aca432cc012247db4b002c9d1ee201e085e9de1953ff75dfe73e81

Sharing

Copy URL Twitter E-mail

General

Target
0e63de6cf4aca432cc012247db4b002c9d1ee201e085e9de1953ff75dfe73e81
Size 45KB
Sample260721-rwk3caah77
SHA256 0e63de6cf4aca432cc012247db4b002c9d1ee201e085e9de1953ff75dfe73e81
MD5 41a93e87b957a9f240320854ea4cdda3
SHA1 366ae5004039e08e1afc84ffbf27d7151d2c01f2
SHA512 e55430060a34c407c4cc86589aa6af3599ce27fe5cfd559d9a0b87afb2284002bb6884418195b917e4888a51949fa4b6254b74e8f3272e9deb0e65a518b55024
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT9Qpm9PIMzjb2gX3iPttf/U/6N/yeBDZUx:cu6YepTPso2GQM3bpXSPttf/U/6N/yw0
TLSH
T1822319003BE8813BF2BE4FB898F26145867AF5637603D54D2CC452D75623BC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

wogblex.com:80
wogblex.com:22
wogblex.com:8080
wogblex.com:8880
wogblex.com:2052
wogblex.com:2082
wogblex.com:2086
wogblex.com:2095
wogblex.com:443
wogblex.com:2053
wogblex.com:2083
wogblex.com:2087
wogblex.com:2096
wogblex.com:8443
www.wogblex.com:80
www.wogblex.com:22
www.wogblex.com:8080
www.wogblex.com:8880
www.wogblex.com:2052
www.wogblex.com:2082
www.wogblex.com:2086
www.wogblex.com:2095
www.wogblex.com:443
www.wogblex.com:2053
www.wogblex.com:2083
www.wogblex.com:2087
www.wogblex.com:2096
www.wogblex.com:8443
remote.wogblex.com:80
remote.wogblex.com:22
remote.wogblex.com:8080
remote.wogblex.com:8880
remote.wogblex.com:2052
remote.wogblex.com:2082
remote.wogblex.com:2086
remote.wogblex.com:2095
remote.wogblex.com:443
remote.wogblex.com:2053
remote.wogblex.com:2083
remote.wogblex.com:2087
remote.wogblex.com:2096
remote.wogblex.com:8443
blaster.wogblex.com:80
blaster.wogblex.com:22
blaster.wogblex.com:8080
blaster.wogblex.com:8880
blaster.wogblex.com:2052
blaster.wogblex.com:2082
blaster.wogblex.com:2086
blaster.wogblex.com:2095
blaster.wogblex.com:443
blaster.wogblex.com:2053
blaster.wogblex.com:2083
blaster.wogblex.com:2087
blaster.wogblex.com:2096
blaster.wogblex.com:8443
nimda.wogblex.com:80
nimda.wogblex.com:22
nimda.wogblex.com:8080
nimda.wogblex.com:8880
nimda.wogblex.com:2052
nimda.wogblex.com:2082
nimda.wogblex.com:2086
nimda.wogblex.com:2095
nimda.wogblex.com:443
nimda.wogblex.com:2053
nimda.wogblex.com:2083
nimda.wogblex.com:2087
nimda.wogblex.com:2096
nimda.wogblex.com:8443
blacklotus.wogblex.com:80
blacklotus.wogblex.com:22
blacklotus.wogblex.com:8080
blacklotus.wogblex.com:8880
blacklotus.wogblex.com:2052
blacklotus.wogblex.com:2082
blacklotus.wogblex.com:2086
blacklotus.wogblex.com:2095
blacklotus.wogblex.com:443
blacklotus.wogblex.com:2053
blacklotus.wogblex.com:2083
blacklotus.wogblex.com:2087
blacklotus.wogblex.com:2096
blacklotus.wogblex.com:8443

Mutex

IShV20RjcZCZ

Attributes

delay
0
install
true
install_file
g891ccr5.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  0e63de6cf4aca432cc012247db4b002c9d1ee201e085e9de1953ff75dfe73e81
- Size 45KB
- SHA256 0e63de6cf4aca432cc012247db4b002c9d1ee201e085e9de1953ff75dfe73e81
- MD5 41a93e87b957a9f240320854ea4cdda3
- SHA1 366ae5004039e08e1afc84ffbf27d7151d2c01f2
- SHA512 e55430060a34c407c4cc86589aa6af3599ce27fe5cfd559d9a0b87afb2284002bb6884418195b917e4888a51949fa4b6254b74e8f3272e9deb0e65a518b55024
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT9Qpm9PIMzjb2gX3iPttf/U/6N/yeBDZUx:cu6YepTPso2GQM3bpXSPttf/U/6N/yw0
- TLSH
  T1822319003BE8813BF2BE4FB898F26145867AF5637603D54D2CC452D75623BC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2