asyncrat | f2e7ccf1f3fc6c8f3006cae3c8c3faa076adccdb0af3ca7b4e9f0a93aefaba82

Sharing

Copy URL Twitter E-mail

General

Target
f2e7ccf1f3fc6c8f3006cae3c8c3faa076adccdb0af3ca7b4e9f0a93aefaba82
Size 45KB
Sample260701-p6wkqagw71
SHA256 f2e7ccf1f3fc6c8f3006cae3c8c3faa076adccdb0af3ca7b4e9f0a93aefaba82
MD5 3c65a89ddb3e348c3730815c04eec44b
SHA1 1522bde7e26e9e9bdfb7ee9638fe05fcf81d86b7
SHA512 306d11ce7deeef1eeab6cb98a9e29feb8fd1f7206a3af22bdc979e1ad4551fdc63b7dc0c79e984ad8962db2034ea45f560ddc0560e126f38be7ada94de188296
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI5TjbygX3iOvzpCLW0P1+BDZ8x:0u1YJTHcw2NgG5Xb1XSOvNCLbdQd8x
TLSH
T121232B1037E8812BF2BE5F78A8F26145867BF5673603D58E1CC4419B5623FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xxxtop.net:80
xxxtop.net:22
xxxtop.net:8080
xxxtop.net:8880
xxxtop.net:2052
xxxtop.net:2082
xxxtop.net:2086
xxxtop.net:2095
xxxtop.net:443
xxxtop.net:2053
xxxtop.net:2083
xxxtop.net:2087
xxxtop.net:2096
xxxtop.net:8443
www.xxxtop.net:80
www.xxxtop.net:22
www.xxxtop.net:8080
www.xxxtop.net:8880
www.xxxtop.net:2052
www.xxxtop.net:2082
www.xxxtop.net:2086
www.xxxtop.net:2095
www.xxxtop.net:443
www.xxxtop.net:2053
www.xxxtop.net:2083
www.xxxtop.net:2087
www.xxxtop.net:2096
www.xxxtop.net:8443
locky.xxxtop.net:80
locky.xxxtop.net:22
locky.xxxtop.net:8080
locky.xxxtop.net:8880
locky.xxxtop.net:2052
locky.xxxtop.net:2082
locky.xxxtop.net:2086
locky.xxxtop.net:2095
locky.xxxtop.net:443
locky.xxxtop.net:2053
locky.xxxtop.net:2083
locky.xxxtop.net:2087
locky.xxxtop.net:2096
locky.xxxtop.net:8443
ryuk.xxxtop.net:80
ryuk.xxxtop.net:22
ryuk.xxxtop.net:8080
ryuk.xxxtop.net:8880
ryuk.xxxtop.net:2052
ryuk.xxxtop.net:2082
ryuk.xxxtop.net:2086
ryuk.xxxtop.net:2095
ryuk.xxxtop.net:443
ryuk.xxxtop.net:2053
ryuk.xxxtop.net:2083
ryuk.xxxtop.net:2087
ryuk.xxxtop.net:2096
ryuk.xxxtop.net:8443
gozi.xxxtop.net:80
gozi.xxxtop.net:22
gozi.xxxtop.net:8080
gozi.xxxtop.net:8880
gozi.xxxtop.net:2052
gozi.xxxtop.net:2082
gozi.xxxtop.net:2086
gozi.xxxtop.net:2095
gozi.xxxtop.net:443
gozi.xxxtop.net:2053
gozi.xxxtop.net:2083
gozi.xxxtop.net:2087
gozi.xxxtop.net:2096
gozi.xxxtop.net:8443
trickbot.xxxtop.net:80
trickbot.xxxtop.net:22
trickbot.xxxtop.net:8080
trickbot.xxxtop.net:8880
trickbot.xxxtop.net:2052
trickbot.xxxtop.net:2082
trickbot.xxxtop.net:2086
trickbot.xxxtop.net:2095
trickbot.xxxtop.net:443
trickbot.xxxtop.net:2053
trickbot.xxxtop.net:2083
trickbot.xxxtop.net:2087
trickbot.xxxtop.net:2096
trickbot.xxxtop.net:8443

Mutex

j71jcztBOCt9

Attributes

delay
0
install
true
install_file
susmm9.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  f2e7ccf1f3fc6c8f3006cae3c8c3faa076adccdb0af3ca7b4e9f0a93aefaba82
- Size 45KB
- SHA256 f2e7ccf1f3fc6c8f3006cae3c8c3faa076adccdb0af3ca7b4e9f0a93aefaba82
- MD5 3c65a89ddb3e348c3730815c04eec44b
- SHA1 1522bde7e26e9e9bdfb7ee9638fe05fcf81d86b7
- SHA512 306d11ce7deeef1eeab6cb98a9e29feb8fd1f7206a3af22bdc979e1ad4551fdc63b7dc0c79e984ad8962db2034ea45f560ddc0560e126f38be7ada94de188296
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI5TjbygX3iOvzpCLW0P1+BDZ8x:0u1YJTHcw2NgG5Xb1XSOvNCLbdQd8x
- TLSH
  T121232B1037E8812BF2BE5F78A8F26145867BF5673603D58E1CC4419B5623FC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2