asyncrat | 961814b0bddb8bf1f7b8e92211b4ec0e042a0c632de0655d116f6639c31409da

Sharing

Copy URL Twitter E-mail

General

Target
961814b0bddb8bf1f7b8e92211b4ec0e042a0c632de0655d116f6639c31409da.exe
Size 45KB
Sample260701-ll8srscz91
SHA256 961814b0bddb8bf1f7b8e92211b4ec0e042a0c632de0655d116f6639c31409da
MD5 4edc6f1248f45417b13df1f9f388e6ce
SHA1 8ad983205e52945fd8cbccac6533c87343b2424c
SHA512 32847f4b323bd1c835db6dc2a7077bf2dbe94f7cce1bcd04fa0d457e2ebcc05cf924aff6e73e4f16688099603c08055f6b032fc6a4404e45d510b5fbf88a950d
SSDEEP 768:Iu7m/5THrq+CWUoDuMmo2qFSTYmUGOTAPI0zjbBgX3ibhGO96EGjsnR6BDZox:Iu7e5TH2A2XURTl03buXSNGhDIRkdox
TLSH
T1862329003BE9813AF27E4F749DF26145867AF2637602DA4A1CC441DB5A23BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexzz.cc:80
sexzz.cc:22
sexzz.cc:8080
sexzz.cc:8880
sexzz.cc:2052
sexzz.cc:2082
sexzz.cc:2086
sexzz.cc:2095
sexzz.cc:443
sexzz.cc:2053
sexzz.cc:2083
sexzz.cc:2087
sexzz.cc:2096
sexzz.cc:8443
www.sexzz.cc:80
www.sexzz.cc:22
www.sexzz.cc:8080
www.sexzz.cc:8880
www.sexzz.cc:2052
www.sexzz.cc:2082
www.sexzz.cc:2086
www.sexzz.cc:2095
www.sexzz.cc:443
www.sexzz.cc:2053
www.sexzz.cc:2083
www.sexzz.cc:2087
www.sexzz.cc:2096
www.sexzz.cc:8443
invasive.sexzz.cc:80
invasive.sexzz.cc:22
invasive.sexzz.cc:8080
invasive.sexzz.cc:8880
invasive.sexzz.cc:2052
invasive.sexzz.cc:2082
invasive.sexzz.cc:2086
invasive.sexzz.cc:2095
invasive.sexzz.cc:443
invasive.sexzz.cc:2053
invasive.sexzz.cc:2083
invasive.sexzz.cc:2087
invasive.sexzz.cc:2096
invasive.sexzz.cc:8443
client.sexzz.cc:80
client.sexzz.cc:22
client.sexzz.cc:8080
client.sexzz.cc:8880
client.sexzz.cc:2052
client.sexzz.cc:2082
client.sexzz.cc:2086
client.sexzz.cc:2095
client.sexzz.cc:443
client.sexzz.cc:2053
client.sexzz.cc:2083
client.sexzz.cc:2087
client.sexzz.cc:2096
client.sexzz.cc:8443
industroyer.sexzz.cc:80
industroyer.sexzz.cc:22
industroyer.sexzz.cc:8080
industroyer.sexzz.cc:8880
industroyer.sexzz.cc:2052
industroyer.sexzz.cc:2082
industroyer.sexzz.cc:2086
industroyer.sexzz.cc:2095
industroyer.sexzz.cc:443
industroyer.sexzz.cc:2053
industroyer.sexzz.cc:2083
industroyer.sexzz.cc:2087
industroyer.sexzz.cc:2096
industroyer.sexzz.cc:8443
sasser.sexzz.cc:80
sasser.sexzz.cc:22
sasser.sexzz.cc:8080
sasser.sexzz.cc:8880
sasser.sexzz.cc:2052
sasser.sexzz.cc:2082
sasser.sexzz.cc:2086
sasser.sexzz.cc:2095
sasser.sexzz.cc:443
sasser.sexzz.cc:2053
sasser.sexzz.cc:2083
sasser.sexzz.cc:2087
sasser.sexzz.cc:2096
sasser.sexzz.cc:8443

Mutex

9q2WfbYnpEv3

Attributes

delay
0
install
true
install_file
ccna2.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  961814b0bddb8bf1f7b8e92211b4ec0e042a0c632de0655d116f6639c31409da.exe
- Size 45KB
- SHA256 961814b0bddb8bf1f7b8e92211b4ec0e042a0c632de0655d116f6639c31409da
- MD5 4edc6f1248f45417b13df1f9f388e6ce
- SHA1 8ad983205e52945fd8cbccac6533c87343b2424c
- SHA512 32847f4b323bd1c835db6dc2a7077bf2dbe94f7cce1bcd04fa0d457e2ebcc05cf924aff6e73e4f16688099603c08055f6b032fc6a4404e45d510b5fbf88a950d
- SSDEEP 768:Iu7m/5THrq+CWUoDuMmo2qFSTYmUGOTAPI0zjbBgX3ibhGO96EGjsnR6BDZox:Iu7e5TH2A2XURTl03buXSNGhDIRkdox
- TLSH
  T1862329003BE9813AF27E4F749DF26145867AF2637602DA4A1CC441DB5A23BC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2