asyncrat | 4ba74f73733d1f35d7c75b7a7ed18622799e84babc031b5d584422ae0b09fb9a

Sharing

Copy URL Twitter E-mail

General

Target
4ba74f73733d1f35d7c75b7a7ed18622799e84babc031b5d584422ae0b09fb9a
Size 45KB
Sample260701-llm63acz7w
SHA256 4ba74f73733d1f35d7c75b7a7ed18622799e84babc031b5d584422ae0b09fb9a
MD5 c76bfe06f87da1d54d82ed3bbc42b6ba
SHA1 6ecd1c660e6bbb667b656f294530c978f5732cdb
SHA512 b531276e609bf9e60cf8c546c95427703e6793b9b35f82589d9de32174c43b3858959278957ca0b63318e6682ca170abeb2b48a484914bd4e69bd3b716665ae0
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFa3xK6yZoOPItzjbag13iuBCu+G3oigtHBDZEx:MuLAZTnbg2vcPo3t3bN1SuBCSghdEx
TLSH
T1E3232B103BE8822BF2BE4F789CF26145467AF2636603D54A1CC4529B5713FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xxxtop.net:80
xxxtop.net:22
xxxtop.net:8080
xxxtop.net:8880
xxxtop.net:2052
xxxtop.net:2082
xxxtop.net:2086
xxxtop.net:2095
xxxtop.net:443
xxxtop.net:2053
xxxtop.net:2083
xxxtop.net:2087
xxxtop.net:2096
xxxtop.net:8443
www.xxxtop.net:80
www.xxxtop.net:22
www.xxxtop.net:8080
www.xxxtop.net:8880
www.xxxtop.net:2052
www.xxxtop.net:2082
www.xxxtop.net:2086
www.xxxtop.net:2095
www.xxxtop.net:443
www.xxxtop.net:2053
www.xxxtop.net:2083
www.xxxtop.net:2087
www.xxxtop.net:2096
www.xxxtop.net:8443
nanocore.xxxtop.net:80
nanocore.xxxtop.net:22
nanocore.xxxtop.net:8080
nanocore.xxxtop.net:8880
nanocore.xxxtop.net:2052
nanocore.xxxtop.net:2082
nanocore.xxxtop.net:2086
nanocore.xxxtop.net:2095
nanocore.xxxtop.net:443
nanocore.xxxtop.net:2053
nanocore.xxxtop.net:2083
nanocore.xxxtop.net:2087
nanocore.xxxtop.net:2096
nanocore.xxxtop.net:8443
sasser.xxxtop.net:80
sasser.xxxtop.net:22
sasser.xxxtop.net:8080
sasser.xxxtop.net:8880
sasser.xxxtop.net:2052
sasser.xxxtop.net:2082
sasser.xxxtop.net:2086
sasser.xxxtop.net:2095
sasser.xxxtop.net:443
sasser.xxxtop.net:2053
sasser.xxxtop.net:2083
sasser.xxxtop.net:2087
sasser.xxxtop.net:2096
sasser.xxxtop.net:8443
ryuk.xxxtop.net:80
ryuk.xxxtop.net:22
ryuk.xxxtop.net:8080
ryuk.xxxtop.net:8880
ryuk.xxxtop.net:2052
ryuk.xxxtop.net:2082
ryuk.xxxtop.net:2086
ryuk.xxxtop.net:2095
ryuk.xxxtop.net:443
ryuk.xxxtop.net:2053
ryuk.xxxtop.net:2083
ryuk.xxxtop.net:2087
ryuk.xxxtop.net:2096
ryuk.xxxtop.net:8443
formbook.xxxtop.net:80
formbook.xxxtop.net:22
formbook.xxxtop.net:8080
formbook.xxxtop.net:8880
formbook.xxxtop.net:2052
formbook.xxxtop.net:2082
formbook.xxxtop.net:2086
formbook.xxxtop.net:2095
formbook.xxxtop.net:443
formbook.xxxtop.net:2053
formbook.xxxtop.net:2083
formbook.xxxtop.net:2087
formbook.xxxtop.net:2096
formbook.xxxtop.net:8443

Mutex

KjT4HInOxX39

Attributes

delay
0
install
true
install_file
ukozk.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4ba74f73733d1f35d7c75b7a7ed18622799e84babc031b5d584422ae0b09fb9a
- Size 45KB
- SHA256 4ba74f73733d1f35d7c75b7a7ed18622799e84babc031b5d584422ae0b09fb9a
- MD5 c76bfe06f87da1d54d82ed3bbc42b6ba
- SHA1 6ecd1c660e6bbb667b656f294530c978f5732cdb
- SHA512 b531276e609bf9e60cf8c546c95427703e6793b9b35f82589d9de32174c43b3858959278957ca0b63318e6682ca170abeb2b48a484914bd4e69bd3b716665ae0
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFa3xK6yZoOPItzjbag13iuBCu+G3oigtHBDZEx:MuLAZTnbg2vcPo3t3bN1SuBCSghdEx
- TLSH
  T1E3232B103BE8822BF2BE4F789CF26145467AF2636603D54A1CC4529B5713FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2