asyncrat | b5887048be301d201d686bb6ddd20ee60770b1ae0eb53fce433a228257323344

Sharing

Copy URL Twitter E-mail

General

Target
b5887048be301d201d686bb6ddd20ee60770b1ae0eb53fce433a228257323344
Size 45KB
Sample260724-rv6bwsscpg
SHA256 b5887048be301d201d686bb6ddd20ee60770b1ae0eb53fce433a228257323344
MD5 e9609144b72db861c98cca9599228c18
SHA1 ce86dad7085f23d196fb4bf189390669a5afecf7
SHA512 1e7e8089100b0ac14a686673d8b4be2f528105115b7f17bdea8a1b11282d20aab37253a705e9a1ce3c8f696a6b95c90c56526a68e5deb07088225ffa6d97b6ad
SSDEEP 768:IuI6epTroGtXWU/jmRmo2qTUwD/y/aqPIDzjbcgX3iGyrccabM77vBDZFx:IuIjpTrlO2tkhD3bzXSG8ck/ZdFx
TLSH
T1AC233B003BEDC12BF2BE5B789DF26145867AF6632A03D5491CC411DB4613FC68A52AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

storage.haysexcdn.net:80
storage.haysexcdn.net:22
storage.haysexcdn.net:8080
storage.haysexcdn.net:8880
storage.haysexcdn.net:2052
storage.haysexcdn.net:2082
storage.haysexcdn.net:2086
storage.haysexcdn.net:2095
storage.haysexcdn.net:443
storage.haysexcdn.net:2053
storage.haysexcdn.net:2083
storage.haysexcdn.net:2087
storage.haysexcdn.net:2096
storage.haysexcdn.net:8443
www.storage.haysexcdn.net:80
www.storage.haysexcdn.net:22
www.storage.haysexcdn.net:8080
www.storage.haysexcdn.net:8880
www.storage.haysexcdn.net:2052
www.storage.haysexcdn.net:2082
www.storage.haysexcdn.net:2086
www.storage.haysexcdn.net:2095
www.storage.haysexcdn.net:443
www.storage.haysexcdn.net:2053
www.storage.haysexcdn.net:2083
www.storage.haysexcdn.net:2087
www.storage.haysexcdn.net:2096
www.storage.haysexcdn.net:8443
mirai.storage.haysexcdn.net:80
mirai.storage.haysexcdn.net:22
mirai.storage.haysexcdn.net:8080
mirai.storage.haysexcdn.net:8880
mirai.storage.haysexcdn.net:2052
mirai.storage.haysexcdn.net:2082
mirai.storage.haysexcdn.net:2086
mirai.storage.haysexcdn.net:2095
mirai.storage.haysexcdn.net:443
mirai.storage.haysexcdn.net:2053
mirai.storage.haysexcdn.net:2083
mirai.storage.haysexcdn.net:2087
mirai.storage.haysexcdn.net:2096
mirai.storage.haysexcdn.net:8443
socgholish.storage.haysexcdn.net:80
socgholish.storage.haysexcdn.net:22
socgholish.storage.haysexcdn.net:8080
socgholish.storage.haysexcdn.net:8880
socgholish.storage.haysexcdn.net:2052
socgholish.storage.haysexcdn.net:2082
socgholish.storage.haysexcdn.net:2086
socgholish.storage.haysexcdn.net:2095
socgholish.storage.haysexcdn.net:443
socgholish.storage.haysexcdn.net:2053
socgholish.storage.haysexcdn.net:2083
socgholish.storage.haysexcdn.net:2087
socgholish.storage.haysexcdn.net:2096
socgholish.storage.haysexcdn.net:8443
locky.storage.haysexcdn.net:80
locky.storage.haysexcdn.net:22
locky.storage.haysexcdn.net:8080
locky.storage.haysexcdn.net:8880
locky.storage.haysexcdn.net:2052
locky.storage.haysexcdn.net:2082
locky.storage.haysexcdn.net:2086
locky.storage.haysexcdn.net:2095
locky.storage.haysexcdn.net:443
locky.storage.haysexcdn.net:2053
locky.storage.haysexcdn.net:2083
locky.storage.haysexcdn.net:2087
locky.storage.haysexcdn.net:2096
locky.storage.haysexcdn.net:8443
lokibot.storage.haysexcdn.net:80
lokibot.storage.haysexcdn.net:22
lokibot.storage.haysexcdn.net:8080
lokibot.storage.haysexcdn.net:8880
lokibot.storage.haysexcdn.net:2052
lokibot.storage.haysexcdn.net:2082
lokibot.storage.haysexcdn.net:2086
lokibot.storage.haysexcdn.net:2095
lokibot.storage.haysexcdn.net:443
lokibot.storage.haysexcdn.net:2053
lokibot.storage.haysexcdn.net:2083
lokibot.storage.haysexcdn.net:2087
lokibot.storage.haysexcdn.net:2096
lokibot.storage.haysexcdn.net:8443

Mutex

6VEJpx9flBOo

Attributes

delay
0
install
true
install_file
d8miea4.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b5887048be301d201d686bb6ddd20ee60770b1ae0eb53fce433a228257323344
- Size 45KB
- SHA256 b5887048be301d201d686bb6ddd20ee60770b1ae0eb53fce433a228257323344
- MD5 e9609144b72db861c98cca9599228c18
- SHA1 ce86dad7085f23d196fb4bf189390669a5afecf7
- SHA512 1e7e8089100b0ac14a686673d8b4be2f528105115b7f17bdea8a1b11282d20aab37253a705e9a1ce3c8f696a6b95c90c56526a68e5deb07088225ffa6d97b6ad
- SSDEEP 768:IuI6epTroGtXWU/jmRmo2qTUwD/y/aqPIDzjbcgX3iGyrccabM77vBDZFx:IuIjpTrlO2tkhD3bzXSG8ck/ZdFx
- TLSH
  T1AC233B003BEDC12BF2BE5B789DF26145867AF6632A03D5491CC411DB4613FC68A52AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2