asyncrat | baa98f6bde7c9b60bc0d67baac00ee5969e254be7b9bdaebcd760e0e2bd35aee

Sharing

Copy URL Twitter E-mail

General

Target
ditnatlon.exe
Size 48KB
Sample260809-r5csbszele
SHA256 baa98f6bde7c9b60bc0d67baac00ee5969e254be7b9bdaebcd760e0e2bd35aee
MD5 1681fd6a2d44b629070824a88f859f7b
SHA1 8f615ca1c810045e6c27db7ccfa4cfc5a29cbdf4
SHA512 276c19b54bfaecaff085706bacef786b317f187c9954170a87f3314c7a3ebe6d5f2f5cb1044ddf183e648eaa1e52eb39a721e47af232b678649e123104c3d18b
SSDEEP 768:Fudk+TA0g9fsqtWUZt9Lmo2qxiy6Hjc/rXYYbPIZ2Sf/p3d0b6ZM9vOkL+ISYun6:Fudk+TARz2Z4rXYvZ2Sf/pKb6Z0vOkF/
TLSH
T10D231B003BE9813AF2BE4F74A9F271458677F2637606D64E1CC4429B5613BC2CA425FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

j8jy8.co/vi-vn/:6606
j8jy8.co/vi-vn/:80
j8jy8.co/vi-vn/:8080
j8jy8.co/vi-vn/:443
j8jy8.co/vi-vn/:8443
j8jy8.co/vi-vn/:22
j8jy8.co/vi-vn/:23
8jok.pw/vi-vn/:6606
8jok.pw/vi-vn/:80
8jok.pw/vi-vn/:8080
8jok.pw/vi-vn/:443
8jok.pw/vi-vn/:8443
8jok.pw/vi-vn/:22
8jok.pw/vi-vn/:23
789win.proficientbookpublishers.co/vn/:6606
789win.proficientbookpublishers.co/vn/:80
789win.proficientbookpublishers.co/vn/:8080
789win.proficientbookpublishers.co/vn/:443
789win.proficientbookpublishers.co/vn/:8443
789win.proficientbookpublishers.co/vn/:22
789win.proficientbookpublishers.co/vn/:23
proficientbookpublishers.co/vn/:6606
proficientbookpublishers.co/vn/:80
proficientbookpublishers.co/vn/:8080
proficientbookpublishers.co/vn/:443
proficientbookpublishers.co/vn/:8443
proficientbookpublishers.co/vn/:22
proficientbookpublishers.co/vn/:23
789winbett.pro/vi-vn/:6606
789winbett.pro/vi-vn/:80
789winbett.pro/vi-vn/:8080
789winbett.pro/vi-vn/:443
789winbett.pro/vi-vn/:8443
789winbett.pro/vi-vn/:22
789winbett.pro/vi-vn/:23
riobet-www.top/vi-vn/:6606
riobet-www.top/vi-vn/:80
riobet-www.top/vi-vn/:8080
riobet-www.top/vi-vn/:443
riobet-www.top/vi-vn/:8443
riobet-www.top/vi-vn/:22
riobet-www.top/vi-vn/:23
riobet-top.top/vi-vn/:6606
riobet-top.top/vi-vn/:80
riobet-top.top/vi-vn/:8080
riobet-top.top/vi-vn/:443
riobet-top.top/vi-vn/:8443
riobet-top.top/vi-vn/:22
riobet-top.top/vi-vn/:23
sherari.nl/vi-vn/:6606
sherari.nl/vi-vn/:80
sherari.nl/vi-vn/:8080
sherari.nl/vi-vn/:443
sherari.nl/vi-vn/:8443
sherari.nl/vi-vn/:22
sherari.nl/vi-vn/:23
pdmt.in/vi-vn/:6606
pdmt.in/vi-vn/:80
pdmt.in/vi-vn/:8080
pdmt.in/vi-vn/:443
pdmt.in/vi-vn/:8443
pdmt.in/vi-vn/:22
pdmt.in/vi-vn/:23
01cb01.me/vi-vn/:6606
01cb01.me/vi-vn/:80
01cb01.me/vi-vn/:8080
01cb01.me/vi-vn/:443
01cb01.me/vi-vn/:8443
01cb01.me/vi-vn/:22
01cb01.me/vi-vn/:23
nk88.royalgroupofcompanies.in/vn/:6606
nk88.royalgroupofcompanies.in/vn/:80
nk88.royalgroupofcompanies.in/vn/:8080
nk88.royalgroupofcompanies.in/vn/:443
nk88.royalgroupofcompanies.in/vn/:8443
nk88.royalgroupofcompanies.in/vn/:22
nk88.royalgroupofcompanies.in/vn/:23
royalgroupofcompanies.in/vn/:6606
royalgroupofcompanies.in/vn/:80
royalgroupofcompanies.in/vn/:8080
royalgroupofcompanies.in/vn/:443
royalgroupofcompanies.in/vn/:8443
royalgroupofcompanies.in/vn/:22
royalgroupofcompanies.in/vn/:23

Mutex

aLhzGntEuq91

Attributes

delay
3
install
true
install_file
GoogleUpdate.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  ditnatlon.exe
- Size 48KB
- SHA256 baa98f6bde7c9b60bc0d67baac00ee5969e254be7b9bdaebcd760e0e2bd35aee
- MD5 1681fd6a2d44b629070824a88f859f7b
- SHA1 8f615ca1c810045e6c27db7ccfa4cfc5a29cbdf4
- SHA512 276c19b54bfaecaff085706bacef786b317f187c9954170a87f3314c7a3ebe6d5f2f5cb1044ddf183e648eaa1e52eb39a721e47af232b678649e123104c3d18b
- SSDEEP 768:Fudk+TA0g9fsqtWUZt9Lmo2qxiy6Hjc/rXYYbPIZ2Sf/p3d0b6ZM9vOkL+ISYun6:Fudk+TARz2Z4rXYvZ2Sf/pKb6Z0vOkF/
- TLSH
  T10D231B003BE9813AF2BE4F74A9F271458677F2637606D64E1CC4429B5613BC2CA425FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2