asyncrat | fbccaeedd6c4e09deda3e4f5444434112fb66d52705bb452ad40e1d199be7160

Sharing

Copy URL Twitter E-mail

General

Target
fbccaeedd6c4e09deda3e4f5444434112fb66d52705bb452ad40e1d199be7160
Size 45KB
Sample260722-klrc2scg26
SHA256 fbccaeedd6c4e09deda3e4f5444434112fb66d52705bb452ad40e1d199be7160
MD5 a244ac6054b74babb9b9c1259d67726e
SHA1 5830a96ff4dbb03ce7a142a0eb4a310076736f8f
SHA512 e444ba74b40cbf7cef9b918ffee6832d13ce6f7515e7dc1553c2ecca62e107b43d63d7896ede0376d71102f5e83f44804bec6aa3ed812e796c6cc9cd2fcf8865
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAf8V1NpxkcPI4zjbZgX3iG2tc8A6BkP9D0MOa5bVy:cuqNJTLr62v8VXPkh43b2XS3tc8feVol
TLSH
T1FA232A003BE8823BF2BE4F7898F26145867AF6632603D54A1CC442DB5713FC69A526FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

dalton-marine.com:80
dalton-marine.com:22
dalton-marine.com:8080
dalton-marine.com:8880
dalton-marine.com:2052
dalton-marine.com:2082
dalton-marine.com:2086
dalton-marine.com:2095
dalton-marine.com:443
dalton-marine.com:2053
dalton-marine.com:2083
dalton-marine.com:2087
dalton-marine.com:2096
dalton-marine.com:8443
www.dalton-marine.com:80
www.dalton-marine.com:22
www.dalton-marine.com:8080
www.dalton-marine.com:8880
www.dalton-marine.com:2052
www.dalton-marine.com:2082
www.dalton-marine.com:2086
www.dalton-marine.com:2095
www.dalton-marine.com:443
www.dalton-marine.com:2053
www.dalton-marine.com:2083
www.dalton-marine.com:2087
www.dalton-marine.com:2096
www.dalton-marine.com:8443
connect.dalton-marine.com:80
connect.dalton-marine.com:22
connect.dalton-marine.com:8080
connect.dalton-marine.com:8880
connect.dalton-marine.com:2052
connect.dalton-marine.com:2082
connect.dalton-marine.com:2086
connect.dalton-marine.com:2095
connect.dalton-marine.com:443
connect.dalton-marine.com:2053
connect.dalton-marine.com:2083
connect.dalton-marine.com:2087
connect.dalton-marine.com:2096
connect.dalton-marine.com:8443
blaster.dalton-marine.com:80
blaster.dalton-marine.com:22
blaster.dalton-marine.com:8080
blaster.dalton-marine.com:8880
blaster.dalton-marine.com:2052
blaster.dalton-marine.com:2082
blaster.dalton-marine.com:2086
blaster.dalton-marine.com:2095
blaster.dalton-marine.com:443
blaster.dalton-marine.com:2053
blaster.dalton-marine.com:2083
blaster.dalton-marine.com:2087
blaster.dalton-marine.com:2096
blaster.dalton-marine.com:8443
shamoon.dalton-marine.com:80
shamoon.dalton-marine.com:22
shamoon.dalton-marine.com:8080
shamoon.dalton-marine.com:8880
shamoon.dalton-marine.com:2052
shamoon.dalton-marine.com:2082
shamoon.dalton-marine.com:2086
shamoon.dalton-marine.com:2095
shamoon.dalton-marine.com:443
shamoon.dalton-marine.com:2053
shamoon.dalton-marine.com:2083
shamoon.dalton-marine.com:2087
shamoon.dalton-marine.com:2096
shamoon.dalton-marine.com:8443
locky.dalton-marine.com:80
locky.dalton-marine.com:22
locky.dalton-marine.com:8080
locky.dalton-marine.com:8880
locky.dalton-marine.com:2052
locky.dalton-marine.com:2082
locky.dalton-marine.com:2086
locky.dalton-marine.com:2095
locky.dalton-marine.com:443
locky.dalton-marine.com:2053
locky.dalton-marine.com:2083
locky.dalton-marine.com:2087
locky.dalton-marine.com:2096
locky.dalton-marine.com:8443

Mutex

XzlgmV5KMdIj

Attributes

delay
0
install
true
install_file
4pst.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  fbccaeedd6c4e09deda3e4f5444434112fb66d52705bb452ad40e1d199be7160
- Size 45KB
- SHA256 fbccaeedd6c4e09deda3e4f5444434112fb66d52705bb452ad40e1d199be7160
- MD5 a244ac6054b74babb9b9c1259d67726e
- SHA1 5830a96ff4dbb03ce7a142a0eb4a310076736f8f
- SHA512 e444ba74b40cbf7cef9b918ffee6832d13ce6f7515e7dc1553c2ecca62e107b43d63d7896ede0376d71102f5e83f44804bec6aa3ed812e796c6cc9cd2fcf8865
- SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAf8V1NpxkcPI4zjbZgX3iG2tc8A6BkP9D0MOa5bVy:cuqNJTLr62v8VXPkh43b2XS3tc8feVol
- TLSH
  T1FA232A003BE8823BF2BE4F7898F26145867AF6632603D54A1CC442DB5713FC69A526FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2