asyncrat | 7160201474a8f2b1360d7d62e42695d90220b0f94d9d3aa90a24b29a2739a983

Sharing

Copy URL Twitter E-mail

General

Target
7160201474a8f2b1360d7d62e42695d90220b0f94d9d3aa90a24b29a2739a983
Size 45KB
Sample260722-lcjsaayxgy
SHA256 7160201474a8f2b1360d7d62e42695d90220b0f94d9d3aa90a24b29a2739a983
MD5 e27436e98b3631216d16638b4a52e006
SHA1 b242a0f5b93409fcecae6287351613c3790f6b58
SHA512 abe8c195c80f73efd181eda33a5c6a26c1b48eb1dd581324a0881cec07059081c3aeac0f380fb8e8ebd0ae0e25c22ca4b7f6da6c0610029e43872ae7cf6e9733
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QPCBjPSNjPI/zjb0gX3iXOJwyj0Yam6ekBDZsx:EufspTf2g2hO5sMSK/3bbXSXOZw3medu
TLSH
T1D9233B0037E8C12BF2BE5F789CF26145467AF2637603E54A2CC452DB5613BC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

flimora.top:80
flimora.top:22
flimora.top:8080
flimora.top:8880
flimora.top:2052
flimora.top:2082
flimora.top:2086
flimora.top:2095
flimora.top:443
flimora.top:2053
flimora.top:2083
flimora.top:2087
flimora.top:2096
flimora.top:8443
www.flimora.top:80
www.flimora.top:22
www.flimora.top:8080
www.flimora.top:8880
www.flimora.top:2052
www.flimora.top:2082
www.flimora.top:2086
www.flimora.top:2095
www.flimora.top:443
www.flimora.top:2053
www.flimora.top:2083
www.flimora.top:2087
www.flimora.top:2096
www.flimora.top:8443
klez.flimora.top:80
klez.flimora.top:22
klez.flimora.top:8080
klez.flimora.top:8880
klez.flimora.top:2052
klez.flimora.top:2082
klez.flimora.top:2086
klez.flimora.top:2095
klez.flimora.top:443
klez.flimora.top:2053
klez.flimora.top:2083
klez.flimora.top:2087
klez.flimora.top:2096
klez.flimora.top:8443
rat.flimora.top:80
rat.flimora.top:22
rat.flimora.top:8080
rat.flimora.top:8880
rat.flimora.top:2052
rat.flimora.top:2082
rat.flimora.top:2086
rat.flimora.top:2095
rat.flimora.top:443
rat.flimora.top:2053
rat.flimora.top:2083
rat.flimora.top:2087
rat.flimora.top:2096
rat.flimora.top:8443
emotet.flimora.top:80
emotet.flimora.top:22
emotet.flimora.top:8080
emotet.flimora.top:8880
emotet.flimora.top:2052
emotet.flimora.top:2082
emotet.flimora.top:2086
emotet.flimora.top:2095
emotet.flimora.top:443
emotet.flimora.top:2053
emotet.flimora.top:2083
emotet.flimora.top:2087
emotet.flimora.top:2096
emotet.flimora.top:8443
trickbot.flimora.top:80
trickbot.flimora.top:22
trickbot.flimora.top:8080
trickbot.flimora.top:8880
trickbot.flimora.top:2052
trickbot.flimora.top:2082
trickbot.flimora.top:2086
trickbot.flimora.top:2095
trickbot.flimora.top:443
trickbot.flimora.top:2053
trickbot.flimora.top:2083
trickbot.flimora.top:2087
trickbot.flimora.top:2096
trickbot.flimora.top:8443

Mutex

agqauRsHMvIE

Attributes

delay
0
install
true
install_file
rslu70w.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  7160201474a8f2b1360d7d62e42695d90220b0f94d9d3aa90a24b29a2739a983
- Size 45KB
- SHA256 7160201474a8f2b1360d7d62e42695d90220b0f94d9d3aa90a24b29a2739a983
- MD5 e27436e98b3631216d16638b4a52e006
- SHA1 b242a0f5b93409fcecae6287351613c3790f6b58
- SHA512 abe8c195c80f73efd181eda33a5c6a26c1b48eb1dd581324a0881cec07059081c3aeac0f380fb8e8ebd0ae0e25c22ca4b7f6da6c0610029e43872ae7cf6e9733
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QPCBjPSNjPI/zjb0gX3iXOJwyj0Yam6ekBDZsx:EufspTf2g2hO5sMSK/3bbXSXOZw3medu
- TLSH
  T1D9233B0037E8C12BF2BE5F789CF26145467AF2637603E54A2CC452DB5613BC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2