asyncrat | 2f54969c0d5d836a217210995cd57fee6c4a58c5bc32f13d605a1eca069e1d0e

Sharing

Copy URL Twitter E-mail

General

Target
2f54969c0d5d836a217210995cd57fee6c4a58c5bc32f13d605a1eca069e1d0e
Size 45KB
Sample260722-nn1laazzaw
SHA256 2f54969c0d5d836a217210995cd57fee6c4a58c5bc32f13d605a1eca069e1d0e
MD5 af3cacc96bfb3f3492733095df48dc93
SHA1 2b9168a6780a2859560e4e26d9104eacb797fc77
SHA512 246a33f2ff2f16d247ba093ffa8fb55a3892b23d6abefd61b7ad237b9bafb2e8a3216821ca0786fb577b4a99b814ad2d41598f25cc23ef90256b23d6be98f61a
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAsqyE0OFUwdexIkDPI+zjbNgX3ipkdktPcdEiMzrE:cuqNJTLr62cqNTwM+3baXSGCiEhzLdUx
TLSH
T13C231A0037E8812BF6BE4B78A9F26141867AF6736603D54A1CC451DB5723BC68A436FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

dalton-marine.com:80
dalton-marine.com:22
dalton-marine.com:8080
dalton-marine.com:8880
dalton-marine.com:2052
dalton-marine.com:2082
dalton-marine.com:2086
dalton-marine.com:2095
dalton-marine.com:443
dalton-marine.com:2053
dalton-marine.com:2083
dalton-marine.com:2087
dalton-marine.com:2096
dalton-marine.com:8443
www.dalton-marine.com:80
www.dalton-marine.com:22
www.dalton-marine.com:8080
www.dalton-marine.com:8880
www.dalton-marine.com:2052
www.dalton-marine.com:2082
www.dalton-marine.com:2086
www.dalton-marine.com:2095
www.dalton-marine.com:443
www.dalton-marine.com:2053
www.dalton-marine.com:2083
www.dalton-marine.com:2087
www.dalton-marine.com:2096
www.dalton-marine.com:8443
sasser.dalton-marine.com:80
sasser.dalton-marine.com:22
sasser.dalton-marine.com:8080
sasser.dalton-marine.com:8880
sasser.dalton-marine.com:2052
sasser.dalton-marine.com:2082
sasser.dalton-marine.com:2086
sasser.dalton-marine.com:2095
sasser.dalton-marine.com:443
sasser.dalton-marine.com:2053
sasser.dalton-marine.com:2083
sasser.dalton-marine.com:2087
sasser.dalton-marine.com:2096
sasser.dalton-marine.com:8443
ryuk.dalton-marine.com:80
ryuk.dalton-marine.com:22
ryuk.dalton-marine.com:8080
ryuk.dalton-marine.com:8880
ryuk.dalton-marine.com:2052
ryuk.dalton-marine.com:2082
ryuk.dalton-marine.com:2086
ryuk.dalton-marine.com:2095
ryuk.dalton-marine.com:443
ryuk.dalton-marine.com:2053
ryuk.dalton-marine.com:2083
ryuk.dalton-marine.com:2087
ryuk.dalton-marine.com:2096
ryuk.dalton-marine.com:8443
blaster.dalton-marine.com:80
blaster.dalton-marine.com:22
blaster.dalton-marine.com:8080
blaster.dalton-marine.com:8880
blaster.dalton-marine.com:2052
blaster.dalton-marine.com:2082
blaster.dalton-marine.com:2086
blaster.dalton-marine.com:2095
blaster.dalton-marine.com:443
blaster.dalton-marine.com:2053
blaster.dalton-marine.com:2083
blaster.dalton-marine.com:2087
blaster.dalton-marine.com:2096
blaster.dalton-marine.com:8443
client.dalton-marine.com:80
client.dalton-marine.com:22
client.dalton-marine.com:8080
client.dalton-marine.com:8880
client.dalton-marine.com:2052
client.dalton-marine.com:2082
client.dalton-marine.com:2086
client.dalton-marine.com:2095
client.dalton-marine.com:443
client.dalton-marine.com:2053
client.dalton-marine.com:2083
client.dalton-marine.com:2087
client.dalton-marine.com:2096
client.dalton-marine.com:8443

Mutex

C7Ef1wGVFqwC

Attributes

delay
0
install
true
install_file
dac1.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2f54969c0d5d836a217210995cd57fee6c4a58c5bc32f13d605a1eca069e1d0e
- Size 45KB
- SHA256 2f54969c0d5d836a217210995cd57fee6c4a58c5bc32f13d605a1eca069e1d0e
- MD5 af3cacc96bfb3f3492733095df48dc93
- SHA1 2b9168a6780a2859560e4e26d9104eacb797fc77
- SHA512 246a33f2ff2f16d247ba093ffa8fb55a3892b23d6abefd61b7ad237b9bafb2e8a3216821ca0786fb577b4a99b814ad2d41598f25cc23ef90256b23d6be98f61a
- SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAsqyE0OFUwdexIkDPI+zjbNgX3ipkdktPcdEiMzrE:cuqNJTLr62cqNTwM+3baXSGCiEhzLdUx
- TLSH
  T13C231A0037E8812BF6BE4B78A9F26141867AF6736603D54A1CC451DB5723BC68A436FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2