asyncrat | 0397d6c5d3a66ff9c408ab73df3d31a193efaf8530ab5de04b0316d01164058a

Sharing

Copy URL Twitter E-mail

General

Target
0397d6c5d3a66ff9c408ab73df3d31a193efaf8530ab5de04b0316d01164058a
Size 45KB
Sample260724-rxlp9sscre
SHA256 0397d6c5d3a66ff9c408ab73df3d31a193efaf8530ab5de04b0316d01164058a
MD5 ca73ddeaba6cd0b9a7f61e8066f6ad42
SHA1 e2e21114cc68700e11c0f69ab3c402c8680c8f64
SHA512 edd666b72b75574d711c97bc09c9c6a884361ee228c7e22e498952a58892d5c4f01f4023d1b9f34270e1c9e9a6d07ff1dfa681044175a510bf18c720e425bad8
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHNd3u40cMOPI08zjbDgXEi6I+JJP2h3Z5wIiBDZEx:MuLAZTnbg2Y8+M3083bcXBM2hJEdEx
TLSH
T185232A003BE8812BF2BE8F7898F26105467AF6737603D64E1CC4519B5723FC69A526ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

storage.haysexcdn.net:80
storage.haysexcdn.net:22
storage.haysexcdn.net:8080
storage.haysexcdn.net:8880
storage.haysexcdn.net:2052
storage.haysexcdn.net:2082
storage.haysexcdn.net:2086
storage.haysexcdn.net:2095
storage.haysexcdn.net:443
storage.haysexcdn.net:2053
storage.haysexcdn.net:2083
storage.haysexcdn.net:2087
storage.haysexcdn.net:2096
storage.haysexcdn.net:8443
www.storage.haysexcdn.net:80
www.storage.haysexcdn.net:22
www.storage.haysexcdn.net:8080
www.storage.haysexcdn.net:8880
www.storage.haysexcdn.net:2052
www.storage.haysexcdn.net:2082
www.storage.haysexcdn.net:2086
www.storage.haysexcdn.net:2095
www.storage.haysexcdn.net:443
www.storage.haysexcdn.net:2053
www.storage.haysexcdn.net:2083
www.storage.haysexcdn.net:2087
www.storage.haysexcdn.net:2096
www.storage.haysexcdn.net:8443
dridex.storage.haysexcdn.net:80
dridex.storage.haysexcdn.net:22
dridex.storage.haysexcdn.net:8080
dridex.storage.haysexcdn.net:8880
dridex.storage.haysexcdn.net:2052
dridex.storage.haysexcdn.net:2082
dridex.storage.haysexcdn.net:2086
dridex.storage.haysexcdn.net:2095
dridex.storage.haysexcdn.net:443
dridex.storage.haysexcdn.net:2053
dridex.storage.haysexcdn.net:2083
dridex.storage.haysexcdn.net:2087
dridex.storage.haysexcdn.net:2096
dridex.storage.haysexcdn.net:8443
fakeupdates.storage.haysexcdn.net:80
fakeupdates.storage.haysexcdn.net:22
fakeupdates.storage.haysexcdn.net:8080
fakeupdates.storage.haysexcdn.net:8880
fakeupdates.storage.haysexcdn.net:2052
fakeupdates.storage.haysexcdn.net:2082
fakeupdates.storage.haysexcdn.net:2086
fakeupdates.storage.haysexcdn.net:2095
fakeupdates.storage.haysexcdn.net:443
fakeupdates.storage.haysexcdn.net:2053
fakeupdates.storage.haysexcdn.net:2083
fakeupdates.storage.haysexcdn.net:2087
fakeupdates.storage.haysexcdn.net:2096
fakeupdates.storage.haysexcdn.net:8443

Mutex

fJOWSBbDHqG2

Attributes

delay
0
install
true
install_file
vd17q.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  0397d6c5d3a66ff9c408ab73df3d31a193efaf8530ab5de04b0316d01164058a
- Size 45KB
- SHA256 0397d6c5d3a66ff9c408ab73df3d31a193efaf8530ab5de04b0316d01164058a
- MD5 ca73ddeaba6cd0b9a7f61e8066f6ad42
- SHA1 e2e21114cc68700e11c0f69ab3c402c8680c8f64
- SHA512 edd666b72b75574d711c97bc09c9c6a884361ee228c7e22e498952a58892d5c4f01f4023d1b9f34270e1c9e9a6d07ff1dfa681044175a510bf18c720e425bad8
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHNd3u40cMOPI08zjbDgXEi6I+JJP2h3Z5wIiBDZEx:MuLAZTnbg2Y8+M3083bcXBM2hJEdEx
- TLSH
  T185232A003BE8812BF2BE8F7898F26105467AF6737603D64E1CC4519B5723FC69A526ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2