asyncrat | 367f2c717724f5457302e8e43128c3f78763dfc208dfc9fa1fd1e1cb74b3114d

Sharing

Copy URL Twitter E-mail

General

Target
367f2c717724f5457302e8e43128c3f78763dfc208dfc9fa1fd1e1cb74b3114d
Size 45KB
Sample260722-lrcmhsserg
SHA256 367f2c717724f5457302e8e43128c3f78763dfc208dfc9fa1fd1e1cb74b3114d
MD5 3f7ae1d2a0a6ff9703103a704dc8faa7
SHA1 dc0372da16df9528eb364cf8a1b7fdc3453e8548
SHA512 586aae4e64da05450a379de6c4bd7b15ac479b1df300b19369f1888391cb8955f3eb0b4583b7134a06c502ccf0d09f205a55ad7b437548e0edf1f5f369abc74f
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4rS70ynzuOPIOzjbVgXYixmQh422NrSDVBDZ0x:8uUIpT4vAj2/Swh3O3byX1xqBpS3d0x
TLSH
T1A9233A003BE8812BF2BE5F74ACF26105867AF6637603D54A2CC4519B5713FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

dalton-marine.com:80
dalton-marine.com:22
dalton-marine.com:8080
dalton-marine.com:8880
dalton-marine.com:2052
dalton-marine.com:2082
dalton-marine.com:2086
dalton-marine.com:2095
dalton-marine.com:443
dalton-marine.com:2053
dalton-marine.com:2083
dalton-marine.com:2087
dalton-marine.com:2096
dalton-marine.com:8443
www.dalton-marine.com:80
www.dalton-marine.com:22
www.dalton-marine.com:8080
www.dalton-marine.com:8880
www.dalton-marine.com:2052
www.dalton-marine.com:2082
www.dalton-marine.com:2086
www.dalton-marine.com:2095
www.dalton-marine.com:443
www.dalton-marine.com:2053
www.dalton-marine.com:2083
www.dalton-marine.com:2087
www.dalton-marine.com:2096
www.dalton-marine.com:8443
client.dalton-marine.com:80
client.dalton-marine.com:22
client.dalton-marine.com:8080
client.dalton-marine.com:8880
client.dalton-marine.com:2052
client.dalton-marine.com:2082
client.dalton-marine.com:2086
client.dalton-marine.com:2095
client.dalton-marine.com:443
client.dalton-marine.com:2053
client.dalton-marine.com:2083
client.dalton-marine.com:2087
client.dalton-marine.com:2096
client.dalton-marine.com:8443
shamoon.dalton-marine.com:80
shamoon.dalton-marine.com:22
shamoon.dalton-marine.com:8080
shamoon.dalton-marine.com:8880
shamoon.dalton-marine.com:2052
shamoon.dalton-marine.com:2082
shamoon.dalton-marine.com:2086
shamoon.dalton-marine.com:2095
shamoon.dalton-marine.com:443
shamoon.dalton-marine.com:2053
shamoon.dalton-marine.com:2083
shamoon.dalton-marine.com:2087
shamoon.dalton-marine.com:2096
shamoon.dalton-marine.com:8443
wannacry.dalton-marine.com:80
wannacry.dalton-marine.com:22
wannacry.dalton-marine.com:8080
wannacry.dalton-marine.com:8880
wannacry.dalton-marine.com:2052
wannacry.dalton-marine.com:2082
wannacry.dalton-marine.com:2086
wannacry.dalton-marine.com:2095
wannacry.dalton-marine.com:443
wannacry.dalton-marine.com:2053
wannacry.dalton-marine.com:2083
wannacry.dalton-marine.com:2087
wannacry.dalton-marine.com:2096
wannacry.dalton-marine.com:8443

Mutex

XgEFNyyuHmbY

Attributes

delay
0
install
true
install_file
0iuypao.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  367f2c717724f5457302e8e43128c3f78763dfc208dfc9fa1fd1e1cb74b3114d
- Size 45KB
- SHA256 367f2c717724f5457302e8e43128c3f78763dfc208dfc9fa1fd1e1cb74b3114d
- MD5 3f7ae1d2a0a6ff9703103a704dc8faa7
- SHA1 dc0372da16df9528eb364cf8a1b7fdc3453e8548
- SHA512 586aae4e64da05450a379de6c4bd7b15ac479b1df300b19369f1888391cb8955f3eb0b4583b7134a06c502ccf0d09f205a55ad7b437548e0edf1f5f369abc74f
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4rS70ynzuOPIOzjbVgXYixmQh422NrSDVBDZ0x:8uUIpT4vAj2/Swh3O3byX1xqBpS3d0x
- TLSH
  T1A9233A003BE8812BF2BE5F74ACF26105867AF6637603D54A2CC4519B5713FC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2