asyncrat | 245a5fafd26c98e8adba3a57f481b57b38e2e945b367554d264f2b2625b5f8f2

Sharing

Copy URL Twitter E-mail

General

Target
245a5fafd26c98e8adba3a57f481b57b38e2e945b367554d264f2b2625b5f8f2
Size 45KB
Sample260722-tlcdkaycrh
SHA256 245a5fafd26c98e8adba3a57f481b57b38e2e945b367554d264f2b2625b5f8f2
MD5 876076c72367826966d5e76092c987b5
SHA1 34d7d1fea9a0c6d05c0f48b729a32f2c1f5f0d7f
SHA512 ae85aa7b54b067fc6c1037c8d35b2240e816e14082bdc9cfd46878b75c818cbac2581acc1977d459507c416c727654b203ac1d83fd4f87efd957ca6f1d0dc570
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVufkLyuObvtkjZPIuzjbUgXpiu24f+m420kBDZEx:MuBGJTPho2HfLuyyjWu3b7XYho+X20SE
TLSH
T127232B003BE9812BF2BF4F7898F26145867AF2633603D54A1CC451DB5623FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

dalton-marine.com:80
dalton-marine.com:22
dalton-marine.com:8080
dalton-marine.com:8880
dalton-marine.com:2052
dalton-marine.com:2082
dalton-marine.com:2086
dalton-marine.com:2095
dalton-marine.com:443
dalton-marine.com:2053
dalton-marine.com:2083
dalton-marine.com:2087
dalton-marine.com:2096
dalton-marine.com:8443
www.dalton-marine.com:80
www.dalton-marine.com:22
www.dalton-marine.com:8080
www.dalton-marine.com:8880
www.dalton-marine.com:2052
www.dalton-marine.com:2082
www.dalton-marine.com:2086
www.dalton-marine.com:2095
www.dalton-marine.com:443
www.dalton-marine.com:2053
www.dalton-marine.com:2083
www.dalton-marine.com:2087
www.dalton-marine.com:2096
www.dalton-marine.com:8443
revil.dalton-marine.com:80
revil.dalton-marine.com:22
revil.dalton-marine.com:8080
revil.dalton-marine.com:8880
revil.dalton-marine.com:2052
revil.dalton-marine.com:2082
revil.dalton-marine.com:2086
revil.dalton-marine.com:2095
revil.dalton-marine.com:443
revil.dalton-marine.com:2053
revil.dalton-marine.com:2083
revil.dalton-marine.com:2087
revil.dalton-marine.com:2096
revil.dalton-marine.com:8443
zeus.dalton-marine.com:80
zeus.dalton-marine.com:22
zeus.dalton-marine.com:8080
zeus.dalton-marine.com:8880
zeus.dalton-marine.com:2052
zeus.dalton-marine.com:2082
zeus.dalton-marine.com:2086
zeus.dalton-marine.com:2095
zeus.dalton-marine.com:443
zeus.dalton-marine.com:2053
zeus.dalton-marine.com:2083
zeus.dalton-marine.com:2087
zeus.dalton-marine.com:2096
zeus.dalton-marine.com:8443
remote.dalton-marine.com:80
remote.dalton-marine.com:22
remote.dalton-marine.com:8080
remote.dalton-marine.com:8880
remote.dalton-marine.com:2052
remote.dalton-marine.com:2082
remote.dalton-marine.com:2086
remote.dalton-marine.com:2095
remote.dalton-marine.com:443
remote.dalton-marine.com:2053
remote.dalton-marine.com:2083
remote.dalton-marine.com:2087
remote.dalton-marine.com:2096
remote.dalton-marine.com:8443

Mutex

d0Q5FiRpUMGZ

Attributes

delay
0
install
true
install_file
9i5q.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  245a5fafd26c98e8adba3a57f481b57b38e2e945b367554d264f2b2625b5f8f2
- Size 45KB
- SHA256 245a5fafd26c98e8adba3a57f481b57b38e2e945b367554d264f2b2625b5f8f2
- MD5 876076c72367826966d5e76092c987b5
- SHA1 34d7d1fea9a0c6d05c0f48b729a32f2c1f5f0d7f
- SHA512 ae85aa7b54b067fc6c1037c8d35b2240e816e14082bdc9cfd46878b75c818cbac2581acc1977d459507c416c727654b203ac1d83fd4f87efd957ca6f1d0dc570
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVufkLyuObvtkjZPIuzjbUgXpiu24f+m420kBDZEx:MuBGJTPho2HfLuyyjWu3b7XYho+X20SE
- TLSH
  T127232B003BE9812BF2BF4F7898F26145867AF2633603D54A1CC451DB5623FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2