asyncrat | dcb1b615ba94fd6bd5c2aaf787921eb31157d4d6247dd31b855a3a9a3a5a724f

Sharing

Copy URL Twitter E-mail

General

Target
dcb1b615ba94fd6bd5c2aaf787921eb31157d4d6247dd31b855a3a9a3a5a724f
Size 45KB
Sample260722-esmesacr5w
SHA256 dcb1b615ba94fd6bd5c2aaf787921eb31157d4d6247dd31b855a3a9a3a5a724f
MD5 9495c98fb6545067260483a1873a9a37
SHA1 c470aad17f3fc232541b117839109a37b49749f9
SHA512 c87968f921037b759c1aa367706787159ccf7b19000005793e35f12e47d054a6fc55c56220d5cdcca52bbf35e9226a08729c198ffd4a99a0e25d93e9a44d90bd
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI5DjbmgX3i5nMSFw3j+5vBDZ8x:0u1YJTHcw2NgG5nb5XS5nMS0mZd8x
TLSH
T18B232B0037E8C22BF2BE4F74A9F26145867AF6673603D6491CC451DB5613FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

dalton-marine.com:80
dalton-marine.com:22
dalton-marine.com:8080
dalton-marine.com:8880
dalton-marine.com:2052
dalton-marine.com:2082
dalton-marine.com:2086
dalton-marine.com:2095
dalton-marine.com:443
dalton-marine.com:2053
dalton-marine.com:2083
dalton-marine.com:2087
dalton-marine.com:2096
dalton-marine.com:8443
www.dalton-marine.com:80
www.dalton-marine.com:22
www.dalton-marine.com:8080
www.dalton-marine.com:8880
www.dalton-marine.com:2052
www.dalton-marine.com:2082
www.dalton-marine.com:2086
www.dalton-marine.com:2095
www.dalton-marine.com:443
www.dalton-marine.com:2053
www.dalton-marine.com:2083
www.dalton-marine.com:2087
www.dalton-marine.com:2096
www.dalton-marine.com:8443
trickbot.dalton-marine.com:80
trickbot.dalton-marine.com:22
trickbot.dalton-marine.com:8080
trickbot.dalton-marine.com:8880
trickbot.dalton-marine.com:2052
trickbot.dalton-marine.com:2082
trickbot.dalton-marine.com:2086
trickbot.dalton-marine.com:2095
trickbot.dalton-marine.com:443
trickbot.dalton-marine.com:2053
trickbot.dalton-marine.com:2083
trickbot.dalton-marine.com:2087
trickbot.dalton-marine.com:2096
trickbot.dalton-marine.com:8443
iloveyou.dalton-marine.com:80
iloveyou.dalton-marine.com:22
iloveyou.dalton-marine.com:8080
iloveyou.dalton-marine.com:8880
iloveyou.dalton-marine.com:2052
iloveyou.dalton-marine.com:2082
iloveyou.dalton-marine.com:2086
iloveyou.dalton-marine.com:2095
iloveyou.dalton-marine.com:443
iloveyou.dalton-marine.com:2053
iloveyou.dalton-marine.com:2083
iloveyou.dalton-marine.com:2087
iloveyou.dalton-marine.com:2096
iloveyou.dalton-marine.com:8443

Mutex

jOUCPaJUtvyt

Attributes

delay
0
install
true
install_file
gcm6t9.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  dcb1b615ba94fd6bd5c2aaf787921eb31157d4d6247dd31b855a3a9a3a5a724f
- Size 45KB
- SHA256 dcb1b615ba94fd6bd5c2aaf787921eb31157d4d6247dd31b855a3a9a3a5a724f
- MD5 9495c98fb6545067260483a1873a9a37
- SHA1 c470aad17f3fc232541b117839109a37b49749f9
- SHA512 c87968f921037b759c1aa367706787159ccf7b19000005793e35f12e47d054a6fc55c56220d5cdcca52bbf35e9226a08729c198ffd4a99a0e25d93e9a44d90bd
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI5DjbmgX3i5nMSFw3j+5vBDZ8x:0u1YJTHcw2NgG5nb5XS5nMS0mZd8x
- TLSH
  T18B232B0037E8C22BF2BE4F74A9F26145867AF6673603D6491CC451DB5613FC68A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2