asyncrat | 49c8d2b2fa16bcb626e9a0e844a1ba55000bd4e7b9c284b71be7431d49794a5b

Sharing

Copy URL Twitter E-mail

General

Target
49c8d2b2fa16bcb626e9a0e844a1ba55000bd4e7b9c284b71be7431d49794a5b
Size 45KB
Sample260721-s5rf6axtcv
SHA256 49c8d2b2fa16bcb626e9a0e844a1ba55000bd4e7b9c284b71be7431d49794a5b
MD5 184368df2633a879bed19078d208c292
SHA1 1ee8a8f6fb2ee2489b96b6faaa5ab2ed9fd4a62b
SHA512 f6bb34d4685e30ca3f7611580a5cf4af8a8e9091b9477038cc1bf4464a245c31de12c141a28d9e4f880e8dd064deb1868c7c14488bf465dbe415f6909e049e9c
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7h/cYssPJZOPIcvzjb+gXhilYIzxUahtfUAeVBDZ+:0ushJTDXgH20MIf3cv3bBXwlYI9NjUxM
TLSH
T185231A003BD8822BF2BE5F7898F26145467AF2673603D58E1CC451DB5723FC68A526EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

dalton-marine.com:80
dalton-marine.com:22
dalton-marine.com:8080
dalton-marine.com:8880
dalton-marine.com:2052
dalton-marine.com:2082
dalton-marine.com:2086
dalton-marine.com:2095
dalton-marine.com:443
dalton-marine.com:2053
dalton-marine.com:2083
dalton-marine.com:2087
dalton-marine.com:2096
dalton-marine.com:8443
www.dalton-marine.com:80
www.dalton-marine.com:22
www.dalton-marine.com:8080
www.dalton-marine.com:8880
www.dalton-marine.com:2052
www.dalton-marine.com:2082
www.dalton-marine.com:2086
www.dalton-marine.com:2095
www.dalton-marine.com:443
www.dalton-marine.com:2053
www.dalton-marine.com:2083
www.dalton-marine.com:2087
www.dalton-marine.com:2096
www.dalton-marine.com:8443
darkside.dalton-marine.com:80
darkside.dalton-marine.com:22
darkside.dalton-marine.com:8080
darkside.dalton-marine.com:8880
darkside.dalton-marine.com:2052
darkside.dalton-marine.com:2082
darkside.dalton-marine.com:2086
darkside.dalton-marine.com:2095
darkside.dalton-marine.com:443
darkside.dalton-marine.com:2053
darkside.dalton-marine.com:2083
darkside.dalton-marine.com:2087
darkside.dalton-marine.com:2096
darkside.dalton-marine.com:8443
shamoon.dalton-marine.com:80
shamoon.dalton-marine.com:22
shamoon.dalton-marine.com:8080
shamoon.dalton-marine.com:8880
shamoon.dalton-marine.com:2052
shamoon.dalton-marine.com:2082
shamoon.dalton-marine.com:2086
shamoon.dalton-marine.com:2095
shamoon.dalton-marine.com:443
shamoon.dalton-marine.com:2053
shamoon.dalton-marine.com:2083
shamoon.dalton-marine.com:2087
shamoon.dalton-marine.com:2096
shamoon.dalton-marine.com:8443
revil.dalton-marine.com:80
revil.dalton-marine.com:22
revil.dalton-marine.com:8080
revil.dalton-marine.com:8880
revil.dalton-marine.com:2052
revil.dalton-marine.com:2082
revil.dalton-marine.com:2086
revil.dalton-marine.com:2095
revil.dalton-marine.com:443
revil.dalton-marine.com:2053
revil.dalton-marine.com:2083
revil.dalton-marine.com:2087
revil.dalton-marine.com:2096
revil.dalton-marine.com:8443
invasive.dalton-marine.com:80
invasive.dalton-marine.com:22
invasive.dalton-marine.com:8080
invasive.dalton-marine.com:8880
invasive.dalton-marine.com:2052
invasive.dalton-marine.com:2082
invasive.dalton-marine.com:2086
invasive.dalton-marine.com:2095
invasive.dalton-marine.com:443
invasive.dalton-marine.com:2053
invasive.dalton-marine.com:2083
invasive.dalton-marine.com:2087
invasive.dalton-marine.com:2096
invasive.dalton-marine.com:8443

Mutex

GA7kjHh9h9Wo

Attributes

delay
0
install
true
install_file
oee05r.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  49c8d2b2fa16bcb626e9a0e844a1ba55000bd4e7b9c284b71be7431d49794a5b
- Size 45KB
- SHA256 49c8d2b2fa16bcb626e9a0e844a1ba55000bd4e7b9c284b71be7431d49794a5b
- MD5 184368df2633a879bed19078d208c292
- SHA1 1ee8a8f6fb2ee2489b96b6faaa5ab2ed9fd4a62b
- SHA512 f6bb34d4685e30ca3f7611580a5cf4af8a8e9091b9477038cc1bf4464a245c31de12c141a28d9e4f880e8dd064deb1868c7c14488bf465dbe415f6909e049e9c
- SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7h/cYssPJZOPIcvzjb+gXhilYIzxUahtfUAeVBDZ+:0ushJTDXgH20MIf3cv3bBXwlYI9NjUxM
- TLSH
  T185231A003BD8822BF2BE5F7898F26145467AF2673603D58E1CC451DB5723FC68A526EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2