asyncrat | c746b6a35f78d857e8549b5f22a39e6307f0038a3246cefbaf021191ac318f70

Sharing

Copy URL Twitter E-mail

General

Target
c746b6a35f78d857e8549b5f22a39e6307f0038a3246cefbaf021191ac318f70
Size 45KB
Sample260722-kbs4ws1hmb
SHA256 c746b6a35f78d857e8549b5f22a39e6307f0038a3246cefbaf021191ac318f70
MD5 9f12df0b9e223d131628d4840e13da5c
SHA1 f811466c76acad97fef910e851aba555e9e758ca
SHA512 e547ec0ef743b1b17366c75c0cbb6e6adb6a8ef0a2dd91d5170d4fdcd9232451ed21d62da05132a713cd0fe659b5dc8abef30354f3135cc807096e6f0e7fbf1e
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9K9YikqHztOPIUzjbjgw3ioiO/8yMJ+LXCH4Q26aBD4:0uPrpT/qY23alK3U3b8wS8/JCnMd8x
TLSH
T199232A003BE8C12BF2BE9F789CF26145867AF1633603D64A1CC452975613FC69A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

dalton-marine.com:80
dalton-marine.com:22
dalton-marine.com:8080
dalton-marine.com:8880
dalton-marine.com:2052
dalton-marine.com:2082
dalton-marine.com:2086
dalton-marine.com:2095
dalton-marine.com:443
dalton-marine.com:2053
dalton-marine.com:2083
dalton-marine.com:2087
dalton-marine.com:2096
dalton-marine.com:8443
www.dalton-marine.com:80
www.dalton-marine.com:22
www.dalton-marine.com:8080
www.dalton-marine.com:8880
www.dalton-marine.com:2052
www.dalton-marine.com:2082
www.dalton-marine.com:2086
www.dalton-marine.com:2095
www.dalton-marine.com:443
www.dalton-marine.com:2053
www.dalton-marine.com:2083
www.dalton-marine.com:2087
www.dalton-marine.com:2096
www.dalton-marine.com:8443
blacklotus.dalton-marine.com:80
blacklotus.dalton-marine.com:22
blacklotus.dalton-marine.com:8080
blacklotus.dalton-marine.com:8880
blacklotus.dalton-marine.com:2052
blacklotus.dalton-marine.com:2082
blacklotus.dalton-marine.com:2086
blacklotus.dalton-marine.com:2095
blacklotus.dalton-marine.com:443
blacklotus.dalton-marine.com:2053
blacklotus.dalton-marine.com:2083
blacklotus.dalton-marine.com:2087
blacklotus.dalton-marine.com:2096
blacklotus.dalton-marine.com:8443
gh0st.dalton-marine.com:80
gh0st.dalton-marine.com:22
gh0st.dalton-marine.com:8080
gh0st.dalton-marine.com:8880
gh0st.dalton-marine.com:2052
gh0st.dalton-marine.com:2082
gh0st.dalton-marine.com:2086
gh0st.dalton-marine.com:2095
gh0st.dalton-marine.com:443
gh0st.dalton-marine.com:2053
gh0st.dalton-marine.com:2083
gh0st.dalton-marine.com:2087
gh0st.dalton-marine.com:2096
gh0st.dalton-marine.com:8443

Mutex

uEDJbqVFZcA0

Attributes

delay
0
install
true
install_file
racrs0h.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c746b6a35f78d857e8549b5f22a39e6307f0038a3246cefbaf021191ac318f70
- Size 45KB
- SHA256 c746b6a35f78d857e8549b5f22a39e6307f0038a3246cefbaf021191ac318f70
- MD5 9f12df0b9e223d131628d4840e13da5c
- SHA1 f811466c76acad97fef910e851aba555e9e758ca
- SHA512 e547ec0ef743b1b17366c75c0cbb6e6adb6a8ef0a2dd91d5170d4fdcd9232451ed21d62da05132a713cd0fe659b5dc8abef30354f3135cc807096e6f0e7fbf1e
- SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9K9YikqHztOPIUzjbjgw3ioiO/8yMJ+LXCH4Q26aBD4:0uPrpT/qY23alK3U3b8wS8/JCnMd8x
- TLSH
  T199232A003BE8C12BF2BE9F789CF26145867AF1633603D64A1CC452975613FC69A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2