asyncrat | 39e5f895a2ca98989013fe3f83ffc1af46c181af79ceae75985b6c304889ea07

Sharing

Copy URL Twitter E-mail

General

Target
39e5f895a2ca98989013fe3f83ffc1af46c181af79ceae75985b6c304889ea07
Size 45KB
Sample260701-llsfsacz71
SHA256 39e5f895a2ca98989013fe3f83ffc1af46c181af79ceae75985b6c304889ea07
MD5 a23d80b885c9c6f7d1a5f54efe1cb17a
SHA1 1c4d4b94a4edc5754bfc06a9f5501f4dd02c14b5
SHA512 c359a98f1779ff93e5307c4f0ff857879b2ce96cce33388c7c75bb4c6d4e370dac9c66e4f4d921277a6cb736b88848f7738c5052253ee557a9f8dafb7be49d97
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sK1YJBOPIxq7zjblg83ii3HjOK6BDZ8x:0u1YJTHcw2uiz3xS3bi8SUH8d8x
TLSH
T18B232B0037D8823AF27E4F7899F26145867AF6672A03D68E1CC451DB5713FC68A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexzz.cc:80
sexzz.cc:22
sexzz.cc:8080
sexzz.cc:8880
sexzz.cc:2052
sexzz.cc:2082
sexzz.cc:2086
sexzz.cc:2095
sexzz.cc:443
sexzz.cc:2053
sexzz.cc:2083
sexzz.cc:2087
sexzz.cc:2096
sexzz.cc:8443
www.sexzz.cc:80
www.sexzz.cc:22
www.sexzz.cc:8080
www.sexzz.cc:8880
www.sexzz.cc:2052
www.sexzz.cc:2082
www.sexzz.cc:2086
www.sexzz.cc:2095
www.sexzz.cc:443
www.sexzz.cc:2053
www.sexzz.cc:2083
www.sexzz.cc:2087
www.sexzz.cc:2096
www.sexzz.cc:8443
wannacry.sexzz.cc:80
wannacry.sexzz.cc:22
wannacry.sexzz.cc:8080
wannacry.sexzz.cc:8880
wannacry.sexzz.cc:2052
wannacry.sexzz.cc:2082
wannacry.sexzz.cc:2086
wannacry.sexzz.cc:2095
wannacry.sexzz.cc:443
wannacry.sexzz.cc:2053
wannacry.sexzz.cc:2083
wannacry.sexzz.cc:2087
wannacry.sexzz.cc:2096
wannacry.sexzz.cc:8443
fakeupdates.sexzz.cc:80
fakeupdates.sexzz.cc:22
fakeupdates.sexzz.cc:8080
fakeupdates.sexzz.cc:8880
fakeupdates.sexzz.cc:2052
fakeupdates.sexzz.cc:2082
fakeupdates.sexzz.cc:2086
fakeupdates.sexzz.cc:2095
fakeupdates.sexzz.cc:443
fakeupdates.sexzz.cc:2053
fakeupdates.sexzz.cc:2083
fakeupdates.sexzz.cc:2087
fakeupdates.sexzz.cc:2096
fakeupdates.sexzz.cc:8443
mydoom.sexzz.cc:80
mydoom.sexzz.cc:22
mydoom.sexzz.cc:8080
mydoom.sexzz.cc:8880
mydoom.sexzz.cc:2052
mydoom.sexzz.cc:2082
mydoom.sexzz.cc:2086
mydoom.sexzz.cc:2095
mydoom.sexzz.cc:443
mydoom.sexzz.cc:2053
mydoom.sexzz.cc:2083
mydoom.sexzz.cc:2087
mydoom.sexzz.cc:2096
mydoom.sexzz.cc:8443
conti.sexzz.cc:80
conti.sexzz.cc:22
conti.sexzz.cc:8080
conti.sexzz.cc:8880
conti.sexzz.cc:2052
conti.sexzz.cc:2082
conti.sexzz.cc:2086
conti.sexzz.cc:2095
conti.sexzz.cc:443
conti.sexzz.cc:2053
conti.sexzz.cc:2083
conti.sexzz.cc:2087
conti.sexzz.cc:2096
conti.sexzz.cc:8443

Mutex

9RneRJ28xOyK

Attributes

delay
0
install
true
install_file
pcizql.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  39e5f895a2ca98989013fe3f83ffc1af46c181af79ceae75985b6c304889ea07
- Size 45KB
- SHA256 39e5f895a2ca98989013fe3f83ffc1af46c181af79ceae75985b6c304889ea07
- MD5 a23d80b885c9c6f7d1a5f54efe1cb17a
- SHA1 1c4d4b94a4edc5754bfc06a9f5501f4dd02c14b5
- SHA512 c359a98f1779ff93e5307c4f0ff857879b2ce96cce33388c7c75bb4c6d4e370dac9c66e4f4d921277a6cb736b88848f7738c5052253ee557a9f8dafb7be49d97
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sK1YJBOPIxq7zjblg83ii3HjOK6BDZ8x:0u1YJTHcw2uiz3xS3bi8SUH8d8x
- TLSH
  T18B232B0037D8823AF27E4F7899F26145867AF6672A03D68E1CC451DB5713FC68A42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2