asyncrat | b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7

Sharing

Copy URL Twitter E-mail

General

Target
b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7
Size 45KB
Sample260701-m7le2act7l
SHA256 b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7
MD5 67103094939af22b6ac429b6a07b0bc6
SHA1 7315146addf96d26d244666ef23c662bd10b7973
SHA512 8658e7a2e2224f487ab498dd8b6213567e80bf1ecaa09626766e7e1afb2fcb40b43d8ffa1b9fb9ecf72e3cf84383ad589578989df6669367d222594f596c9813
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1yp7EcPIpzjbMgX3ik/7FmzV/V8Z//dpBDZEx:MuBGJTPho2t8V41Ehp3bDXSk/szS//ZE
TLSH
T13D2319003BE9822BF2BE4FB899F26185867BF2633603D64D2CC451975613BC6D6426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sextop68.com:80
sextop68.com:22
sextop68.com:8080
sextop68.com:8880
sextop68.com:2052
sextop68.com:2082
sextop68.com:2086
sextop68.com:2095
sextop68.com:443
sextop68.com:2053
sextop68.com:2083
sextop68.com:2087
sextop68.com:2096
sextop68.com:8443
www.sextop68.com:80
www.sextop68.com:22
www.sextop68.com:8080
www.sextop68.com:8880
www.sextop68.com:2052
www.sextop68.com:2082
www.sextop68.com:2086
www.sextop68.com:2095
www.sextop68.com:443
www.sextop68.com:2053
www.sextop68.com:2083
www.sextop68.com:2087
www.sextop68.com:2096
www.sextop68.com:8443
mirai.sextop68.com:80
mirai.sextop68.com:22
mirai.sextop68.com:8080
mirai.sextop68.com:8880
mirai.sextop68.com:2052
mirai.sextop68.com:2082
mirai.sextop68.com:2086
mirai.sextop68.com:2095
mirai.sextop68.com:443
mirai.sextop68.com:2053
mirai.sextop68.com:2083
mirai.sextop68.com:2087
mirai.sextop68.com:2096
mirai.sextop68.com:8443
locky.sextop68.com:80
locky.sextop68.com:22
locky.sextop68.com:8080
locky.sextop68.com:8880
locky.sextop68.com:2052
locky.sextop68.com:2082
locky.sextop68.com:2086
locky.sextop68.com:2095
locky.sextop68.com:443
locky.sextop68.com:2053
locky.sextop68.com:2083
locky.sextop68.com:2087
locky.sextop68.com:2096
locky.sextop68.com:8443
invasive.sextop68.com:80
invasive.sextop68.com:22
invasive.sextop68.com:8080
invasive.sextop68.com:8880
invasive.sextop68.com:2052
invasive.sextop68.com:2082
invasive.sextop68.com:2086
invasive.sextop68.com:2095
invasive.sextop68.com:443
invasive.sextop68.com:2053
invasive.sextop68.com:2083
invasive.sextop68.com:2087
invasive.sextop68.com:2096
invasive.sextop68.com:8443
sobig.sextop68.com:80
sobig.sextop68.com:22
sobig.sextop68.com:8080
sobig.sextop68.com:8880
sobig.sextop68.com:2052
sobig.sextop68.com:2082
sobig.sextop68.com:2086
sobig.sextop68.com:2095
sobig.sextop68.com:443
sobig.sextop68.com:2053
sobig.sextop68.com:2083
sobig.sextop68.com:2087
sobig.sextop68.com:2096
sobig.sextop68.com:8443

Mutex

M6aDXC58N9Fz

Attributes

delay
0
install
true
install_file
pxyw.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7
- Size 45KB
- SHA256 b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7
- MD5 67103094939af22b6ac429b6a07b0bc6
- SHA1 7315146addf96d26d244666ef23c662bd10b7973
- SHA512 8658e7a2e2224f487ab498dd8b6213567e80bf1ecaa09626766e7e1afb2fcb40b43d8ffa1b9fb9ecf72e3cf84383ad589578989df6669367d222594f596c9813
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1yp7EcPIpzjbMgX3ik/7FmzV/V8Z//dpBDZEx:MuBGJTPho2t8V41Ehp3bDXSk/szS//ZE
- TLSH
  T13D2319003BE9822BF2BE4FB899F26185867BF2633603D64D2CC451975613BC6D6426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2