asyncrat | 41fcff2deeb1fcd789ca80486c4ada61d83e48fb1751fd1c7f5cce0663e0f253

Sharing

Copy URL Twitter E-mail

General

Target
41fcff2deeb1fcd789ca80486c4ada61d83e48fb1751fd1c7f5cce0663e0f253
Size 45KB
Sample260722-t36zhayeqa
SHA256 41fcff2deeb1fcd789ca80486c4ada61d83e48fb1751fd1c7f5cce0663e0f253
MD5 ea961dff7877379f69814df2dc4af1d9
SHA1 9920b1a41d0ec22229095dd645d1842670c397b9
SHA512 e68bcdf937cc98924971f58dd2fd9c1aa85bd9234b03727a8968e1d0a49801b7050b23b1518ca7c6b49570fe9862c949a86658b79d6d103a33ac2f3b48db3e22
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVIQLD3q/vKijZPIgzjb2g53iYbwPYBRmuA8BBDZEx:MuBGJTPho2f23iHjWg3bp5SYbDp/dEx
TLSH
T1E5230A003BE9812BF2BE4F7898F26245867EF6732603D6491CC451DB5713BC69642AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

wogblex.com:80
wogblex.com:22
wogblex.com:8080
wogblex.com:8880
wogblex.com:2052
wogblex.com:2082
wogblex.com:2086
wogblex.com:2095
wogblex.com:443
wogblex.com:2053
wogblex.com:2083
wogblex.com:2087
wogblex.com:2096
wogblex.com:8443
www.wogblex.com:80
www.wogblex.com:22
www.wogblex.com:8080
www.wogblex.com:8880
www.wogblex.com:2052
www.wogblex.com:2082
www.wogblex.com:2086
www.wogblex.com:2095
www.wogblex.com:443
www.wogblex.com:2053
www.wogblex.com:2083
www.wogblex.com:2087
www.wogblex.com:2096
www.wogblex.com:8443
triton.wogblex.com:80
triton.wogblex.com:22
triton.wogblex.com:8080
triton.wogblex.com:8880
triton.wogblex.com:2052
triton.wogblex.com:2082
triton.wogblex.com:2086
triton.wogblex.com:2095
triton.wogblex.com:443
triton.wogblex.com:2053
triton.wogblex.com:2083
triton.wogblex.com:2087
triton.wogblex.com:2096
triton.wogblex.com:8443
gozi.wogblex.com:80
gozi.wogblex.com:22
gozi.wogblex.com:8080
gozi.wogblex.com:8880
gozi.wogblex.com:2052
gozi.wogblex.com:2082
gozi.wogblex.com:2086
gozi.wogblex.com:2095
gozi.wogblex.com:443
gozi.wogblex.com:2053
gozi.wogblex.com:2083
gozi.wogblex.com:2087
gozi.wogblex.com:2096
gozi.wogblex.com:8443
sasser.wogblex.com:80
sasser.wogblex.com:22
sasser.wogblex.com:8080
sasser.wogblex.com:8880
sasser.wogblex.com:2052
sasser.wogblex.com:2082
sasser.wogblex.com:2086
sasser.wogblex.com:2095
sasser.wogblex.com:443
sasser.wogblex.com:2053
sasser.wogblex.com:2083
sasser.wogblex.com:2087
sasser.wogblex.com:2096
sasser.wogblex.com:8443
locky.wogblex.com:80
locky.wogblex.com:22
locky.wogblex.com:8080
locky.wogblex.com:8880
locky.wogblex.com:2052
locky.wogblex.com:2082
locky.wogblex.com:2086
locky.wogblex.com:2095
locky.wogblex.com:443
locky.wogblex.com:2053
locky.wogblex.com:2083
locky.wogblex.com:2087
locky.wogblex.com:2096
locky.wogblex.com:8443

Mutex

g9w7PAXv0uVi

Attributes

delay
0
install
true
install_file
s2in.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  41fcff2deeb1fcd789ca80486c4ada61d83e48fb1751fd1c7f5cce0663e0f253
- Size 45KB
- SHA256 41fcff2deeb1fcd789ca80486c4ada61d83e48fb1751fd1c7f5cce0663e0f253
- MD5 ea961dff7877379f69814df2dc4af1d9
- SHA1 9920b1a41d0ec22229095dd645d1842670c397b9
- SHA512 e68bcdf937cc98924971f58dd2fd9c1aa85bd9234b03727a8968e1d0a49801b7050b23b1518ca7c6b49570fe9862c949a86658b79d6d103a33ac2f3b48db3e22
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVIQLD3q/vKijZPIgzjb2g53iYbwPYBRmuA8BBDZEx:MuBGJTPho2f23iHjWg3bp5SYbDp/dEx
- TLSH
  T1E5230A003BE9812BF2BE4F7898F26245867EF6732603D6491CC451DB5713BC69642AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2