asyncrat | 341fbd33ef4e35bef54deae185ff5495245dc46830534cf3b75b68327f47ea75

Sharing

Copy URL Twitter E-mail

General

Target
341fbd33ef4e35bef54deae185ff5495245dc46830534cf3b75b68327f47ea75
Size 45KB
Sample260803-zdwp5abl8z
SHA256 341fbd33ef4e35bef54deae185ff5495245dc46830534cf3b75b68327f47ea75
MD5 d279d59ceaa7ab78b8db17576dbaf4c6
SHA1 7400338ccec1371d1856d9bed84af8a4dc270c52
SHA512 929434ed0be05dd3932bf413d9afc2753f23a2faa2ea80fd51a2d3a8bbb3bea2ea74df582cacd5450634bcd63d37c2149246b6a73efc74b6b665ab96029ae7dd
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAvT9Qpm9PInzjbZgX3i+F4QLSKQzSPDUaIkxBDZcx:UuKWgSJTwRf2hQn3b2XS+F1ePggIdcx
TLSH
T1DC232B003BE9C13BF27E4FB858F26145867AF5636603D64D2CC451DB5623FC6CA426EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

haysexcdn.net:80
haysexcdn.net:22
haysexcdn.net:8080
haysexcdn.net:8880
haysexcdn.net:2052
haysexcdn.net:2082
haysexcdn.net:2086
haysexcdn.net:2095
haysexcdn.net:443
haysexcdn.net:2053
haysexcdn.net:2083
haysexcdn.net:2087
haysexcdn.net:2096
haysexcdn.net:8443
www.haysexcdn.net:80
www.haysexcdn.net:22
www.haysexcdn.net:8080
www.haysexcdn.net:8880
www.haysexcdn.net:2052
www.haysexcdn.net:2082
www.haysexcdn.net:2086
www.haysexcdn.net:2095
www.haysexcdn.net:443
www.haysexcdn.net:2053
www.haysexcdn.net:2083
www.haysexcdn.net:2087
www.haysexcdn.net:2096
www.haysexcdn.net:8443
qbot.haysexcdn.net:80
qbot.haysexcdn.net:22
qbot.haysexcdn.net:8080
qbot.haysexcdn.net:8880
qbot.haysexcdn.net:2052
qbot.haysexcdn.net:2082
qbot.haysexcdn.net:2086
qbot.haysexcdn.net:2095
qbot.haysexcdn.net:443
qbot.haysexcdn.net:2053
qbot.haysexcdn.net:2083
qbot.haysexcdn.net:2087
qbot.haysexcdn.net:2096
qbot.haysexcdn.net:8443
connect.haysexcdn.net:80
connect.haysexcdn.net:22
connect.haysexcdn.net:8080
connect.haysexcdn.net:8880
connect.haysexcdn.net:2052
connect.haysexcdn.net:2082
connect.haysexcdn.net:2086
connect.haysexcdn.net:2095
connect.haysexcdn.net:443
connect.haysexcdn.net:2053
connect.haysexcdn.net:2083
connect.haysexcdn.net:2087
connect.haysexcdn.net:2096
connect.haysexcdn.net:8443
downadup.haysexcdn.net:80
downadup.haysexcdn.net:22
downadup.haysexcdn.net:8080
downadup.haysexcdn.net:8880
downadup.haysexcdn.net:2052
downadup.haysexcdn.net:2082
downadup.haysexcdn.net:2086
downadup.haysexcdn.net:2095
downadup.haysexcdn.net:443
downadup.haysexcdn.net:2053
downadup.haysexcdn.net:2083
downadup.haysexcdn.net:2087
downadup.haysexcdn.net:2096
downadup.haysexcdn.net:8443
notpetya.haysexcdn.net:80
notpetya.haysexcdn.net:22
notpetya.haysexcdn.net:8080
notpetya.haysexcdn.net:8880
notpetya.haysexcdn.net:2052
notpetya.haysexcdn.net:2082
notpetya.haysexcdn.net:2086
notpetya.haysexcdn.net:2095
notpetya.haysexcdn.net:443
notpetya.haysexcdn.net:2053
notpetya.haysexcdn.net:2083
notpetya.haysexcdn.net:2087
notpetya.haysexcdn.net:2096
notpetya.haysexcdn.net:8443

Mutex

zfxLWzUiw4hW

Attributes

delay
0
install
true
install_file
1oujtn06.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  341fbd33ef4e35bef54deae185ff5495245dc46830534cf3b75b68327f47ea75
- Size 45KB
- SHA256 341fbd33ef4e35bef54deae185ff5495245dc46830534cf3b75b68327f47ea75
- MD5 d279d59ceaa7ab78b8db17576dbaf4c6
- SHA1 7400338ccec1371d1856d9bed84af8a4dc270c52
- SHA512 929434ed0be05dd3932bf413d9afc2753f23a2faa2ea80fd51a2d3a8bbb3bea2ea74df582cacd5450634bcd63d37c2149246b6a73efc74b6b665ab96029ae7dd
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAvT9Qpm9PInzjbZgX3i+F4QLSKQzSPDUaIkxBDZcx:UuKWgSJTwRf2hQn3b2XS+F1ePggIdcx
- TLSH
  T1DC232B003BE9C13BF27E4FB858F26145867AF5636603D64D2CC451DB5623FC6CA426EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2