asyncrat | fd4b2f1676e35d022923a041e0b8c373e6702f2c5512b53c772e7ffa7c2596bb

General

Target
HOIC.zip
Size 6.3MB
Sample260805-3cd1gatth1
SHA256 fd4b2f1676e35d022923a041e0b8c373e6702f2c5512b53c772e7ffa7c2596bb
MD5 1cdad3a1756757613788149fceeb42fa
SHA1 6d03504e5ee66dcc2cd340b9c79388b77bb2de56
SHA512 817f7b4b83067c0b7fdf83d9a63467a874fcd54d34391398774cf17bb7fbb38f5ca632301f759ed899fe96c1dd4df083b8a927cf6572700b6d4981ac6ed5be91
SSDEEP 196608:NRBQ+7WkRGVFUJen3i1CuY0jsueNmk7db:NRBQ+7o3pnSxY0ji7b
TLSH
T10A663396CCB828DB89EE7B309ACF42D7AB972374C81B3F10B1D1189D55D10A1670DEB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

108.252.227.16:3001

Attributes

delay
1
install
true
install_file
Runtime Broker.exe
install_folder
%AppData%
local_host
127.0.0.1

aes.plain

Targets

- Target
  HOIC.zip
- Size 6.3MB
- SHA256 fd4b2f1676e35d022923a041e0b8c373e6702f2c5512b53c772e7ffa7c2596bb
- MD5 1cdad3a1756757613788149fceeb42fa
- SHA1 6d03504e5ee66dcc2cd340b9c79388b77bb2de56
- SHA512 817f7b4b83067c0b7fdf83d9a63467a874fcd54d34391398774cf17bb7fbb38f5ca632301f759ed899fe96c1dd4df083b8a927cf6572700b6d4981ac6ed5be91
- SSDEEP 196608:NRBQ+7WkRGVFUJen3i1CuY0jsueNmk7db:NRBQ+7o3pnSxY0ji7b
- TLSH
  T10A663396CCB828DB89EE7B309ACF42D7AB972374C81B3F10B1D1189D55D10A1670DEB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Hoic/HOIC2.1.exe
- Size 8.8MB
- SHA256 48ecf6d914380194195b12cab44a8ea82e208223f48a4ed419a7cc71d3f10de5
- MD5 35a2f07162cf90fe2247ab3a46993e18
- SHA1 aeb6fd5d9cca88a552a39ce28ee820e9b863a6dc
- SHA512 39d44c7e090ef537372d9f58cff4fc6fdfd54ece447d686f0828f636a08249974d4bfd12c284ca709b072963fc3de03730039680a5a9a408aef4ce3db8146914
- SSDEEP 196608:gyHeCnB21GFbuRSXMJalN8GDqp7ThjWQd:HngapXMJ4mHd
- TLSH
  T12596C0516D4C37EC801298FE6C186864E89D5B92E6FAF6D2359A0C32DFC349F6D6180F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat trojan
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral3 behavioral4