asyncrat | 5b0d958b936ea9c0141075c07ab486851fe90d526a349b6ee2e110b3a23be3c6

Sharing

Copy URL Twitter E-mail

General

Target
5b0d958b936ea9c0141075c07ab486851fe90d526a349b6ee2e110b3a23be3c6
Size 45KB
Sample260907-yf637svblc
SHA256 5b0d958b936ea9c0141075c07ab486851fe90d526a349b6ee2e110b3a23be3c6
MD5 b9eaa3175f4501f177c808c246406ee3
SHA1 504a84833319fcce9faa6982a19abf13bd3fd9c2
SHA512 5ff049874af7fbf75584fec0a3a2c2b1dd0bf740b27286aa56052e04449ea8b7812e39ff957e1834659bdbba7ea51c2cef850a1a34c437f7feb06b32b61df30c
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4IcQSCBznqNLPI7zjb2gX3i0Eo550lGKbnNhBDZ0x:8uUIpT4vAj28c9UqC73bpXS0EwRGnNfU
TLSH
T191231B003BE8812BF2BE4F7499F26145867AF6633603D54E2CC452DB5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

gainung-tv.net:80
gainung-tv.net:22
gainung-tv.net:8080
gainung-tv.net:8880
gainung-tv.net:2052
gainung-tv.net:2082
gainung-tv.net:2086
gainung-tv.net:2095
gainung-tv.net:443
gainung-tv.net:2053
gainung-tv.net:2083
gainung-tv.net:2087
gainung-tv.net:2096
gainung-tv.net:8443
www.gainung-tv.net:80
www.gainung-tv.net:22
www.gainung-tv.net:8080
www.gainung-tv.net:8880
www.gainung-tv.net:2052
www.gainung-tv.net:2082
www.gainung-tv.net:2086
www.gainung-tv.net:2095
www.gainung-tv.net:443
www.gainung-tv.net:2053
www.gainung-tv.net:2083
www.gainung-tv.net:2087
www.gainung-tv.net:2096
www.gainung-tv.net:8443
gootloader.gainung-tv.net:80
gootloader.gainung-tv.net:22
gootloader.gainung-tv.net:8080
gootloader.gainung-tv.net:8880
gootloader.gainung-tv.net:2052
gootloader.gainung-tv.net:2082
gootloader.gainung-tv.net:2086
gootloader.gainung-tv.net:2095
gootloader.gainung-tv.net:443
gootloader.gainung-tv.net:2053
gootloader.gainung-tv.net:2083
gootloader.gainung-tv.net:2087
gootloader.gainung-tv.net:2096
gootloader.gainung-tv.net:8443
klez.gainung-tv.net:80
klez.gainung-tv.net:22
klez.gainung-tv.net:8080
klez.gainung-tv.net:8880
klez.gainung-tv.net:2052
klez.gainung-tv.net:2082
klez.gainung-tv.net:2086
klez.gainung-tv.net:2095
klez.gainung-tv.net:443
klez.gainung-tv.net:2053
klez.gainung-tv.net:2083
klez.gainung-tv.net:2087
klez.gainung-tv.net:2096
klez.gainung-tv.net:8443
hack.gainung-tv.net:80
hack.gainung-tv.net:22
hack.gainung-tv.net:8080
hack.gainung-tv.net:8880
hack.gainung-tv.net:2052
hack.gainung-tv.net:2082
hack.gainung-tv.net:2086
hack.gainung-tv.net:2095
hack.gainung-tv.net:443
hack.gainung-tv.net:2053
hack.gainung-tv.net:2083
hack.gainung-tv.net:2087
hack.gainung-tv.net:2096
hack.gainung-tv.net:8443
ursnif.gainung-tv.net:80
ursnif.gainung-tv.net:22
ursnif.gainung-tv.net:8080
ursnif.gainung-tv.net:8880
ursnif.gainung-tv.net:2052
ursnif.gainung-tv.net:2082
ursnif.gainung-tv.net:2086
ursnif.gainung-tv.net:2095
ursnif.gainung-tv.net:443
ursnif.gainung-tv.net:2053
ursnif.gainung-tv.net:2083
ursnif.gainung-tv.net:2087
ursnif.gainung-tv.net:2096
ursnif.gainung-tv.net:8443

Mutex

10c8coS7bEEP

Attributes

delay
0
install
true
install_file
5ixjnbz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5b0d958b936ea9c0141075c07ab486851fe90d526a349b6ee2e110b3a23be3c6
- Size 45KB
- SHA256 5b0d958b936ea9c0141075c07ab486851fe90d526a349b6ee2e110b3a23be3c6
- MD5 b9eaa3175f4501f177c808c246406ee3
- SHA1 504a84833319fcce9faa6982a19abf13bd3fd9c2
- SHA512 5ff049874af7fbf75584fec0a3a2c2b1dd0bf740b27286aa56052e04449ea8b7812e39ff957e1834659bdbba7ea51c2cef850a1a34c437f7feb06b32b61df30c
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4IcQSCBznqNLPI7zjb2gX3i0Eo550lGKbnNhBDZ0x:8uUIpT4vAj28c9UqC73bpXS0EwRGnNfU
- TLSH
  T191231B003BE8812BF2BE4F7499F26145867AF6633603D54E2CC452DB5613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2