asyncrat | 68654befa6b75b37af3ab130a433974197af29226850eb0545ec3ac3af1b6daf

Sharing

Copy URL Twitter E-mail

General

Target
68654befa6b75b37af3ab130a433974197af29226850eb0545ec3ac3af1b6daf
Size 45KB
Sample260804-yyfzqsxva1
SHA256 68654befa6b75b37af3ab130a433974197af29226850eb0545ec3ac3af1b6daf
MD5 723185440f94c4f34045e6ad66750873
SHA1 9064255cd826d5b3ccba6e6e2d45dc33ca32180a
SHA512 ff3a347709f8bf353718330cc7b28e5ffa81e7bed6984e48a41bcd02dec7cc5c65d97e66f78e2d3602f34de97684bf4fe663cbb86c2a7604de3fc724ca8f5ce9
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYhoRQKIJOPIhzjb+g/3iTtb2JknE+fBDZ0x:8uuSpTgyf2JYxg3h3bB/S0JkXpd0x
TLSH
T1B4233B003BE8812BF1BE4F78ACF26245467AE2673603D54E1CC451DB5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cwlottery.com:80
cwlottery.com:22
cwlottery.com:8080
cwlottery.com:8880
cwlottery.com:2052
cwlottery.com:2082
cwlottery.com:2086
cwlottery.com:2095
cwlottery.com:443
cwlottery.com:2053
cwlottery.com:2083
cwlottery.com:2087
cwlottery.com:2096
cwlottery.com:8443
www.cwlottery.com:80
www.cwlottery.com:22
www.cwlottery.com:8080
www.cwlottery.com:8880
www.cwlottery.com:2052
www.cwlottery.com:2082
www.cwlottery.com:2086
www.cwlottery.com:2095
www.cwlottery.com:443
www.cwlottery.com:2053
www.cwlottery.com:2083
www.cwlottery.com:2087
www.cwlottery.com:2096
www.cwlottery.com:8443
fakeupdates.cwlottery.com:80
fakeupdates.cwlottery.com:22
fakeupdates.cwlottery.com:8080
fakeupdates.cwlottery.com:8880
fakeupdates.cwlottery.com:2052
fakeupdates.cwlottery.com:2082
fakeupdates.cwlottery.com:2086
fakeupdates.cwlottery.com:2095
fakeupdates.cwlottery.com:443
fakeupdates.cwlottery.com:2053
fakeupdates.cwlottery.com:2083
fakeupdates.cwlottery.com:2087
fakeupdates.cwlottery.com:2096
fakeupdates.cwlottery.com:8443
locky.cwlottery.com:80
locky.cwlottery.com:22
locky.cwlottery.com:8080
locky.cwlottery.com:8880
locky.cwlottery.com:2052
locky.cwlottery.com:2082
locky.cwlottery.com:2086
locky.cwlottery.com:2095
locky.cwlottery.com:443
locky.cwlottery.com:2053
locky.cwlottery.com:2083
locky.cwlottery.com:2087
locky.cwlottery.com:2096
locky.cwlottery.com:8443
malware.cwlottery.com:80
malware.cwlottery.com:22
malware.cwlottery.com:8080
malware.cwlottery.com:8880
malware.cwlottery.com:2052
malware.cwlottery.com:2082
malware.cwlottery.com:2086
malware.cwlottery.com:2095
malware.cwlottery.com:443
malware.cwlottery.com:2053
malware.cwlottery.com:2083
malware.cwlottery.com:2087
malware.cwlottery.com:2096
malware.cwlottery.com:8443
sasser.cwlottery.com:80
sasser.cwlottery.com:22
sasser.cwlottery.com:8080
sasser.cwlottery.com:8880
sasser.cwlottery.com:2052
sasser.cwlottery.com:2082
sasser.cwlottery.com:2086
sasser.cwlottery.com:2095
sasser.cwlottery.com:443
sasser.cwlottery.com:2053
sasser.cwlottery.com:2083
sasser.cwlottery.com:2087
sasser.cwlottery.com:2096
sasser.cwlottery.com:8443

Mutex

87IrGRkrJeXK

Attributes

delay
0
install
true
install_file
3rc62h.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  68654befa6b75b37af3ab130a433974197af29226850eb0545ec3ac3af1b6daf
- Size 45KB
- SHA256 68654befa6b75b37af3ab130a433974197af29226850eb0545ec3ac3af1b6daf
- MD5 723185440f94c4f34045e6ad66750873
- SHA1 9064255cd826d5b3ccba6e6e2d45dc33ca32180a
- SHA512 ff3a347709f8bf353718330cc7b28e5ffa81e7bed6984e48a41bcd02dec7cc5c65d97e66f78e2d3602f34de97684bf4fe663cbb86c2a7604de3fc724ca8f5ce9
- SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYhoRQKIJOPIhzjb+g/3iTtb2JknE+fBDZ0x:8uuSpTgyf2JYxg3h3bB/S0JkXpd0x
- TLSH
  T1B4233B003BE8812BF1BE4F78ACF26245467AE2673603D54E1CC451DB5613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2