asyncrat | ab6bd14c49ebda993f0ba3198cf52ee04dd96389eaf985ce36f08cd67d2059d3

Sharing

Copy URL Twitter E-mail

General

Target
ab6bd14c49ebda993f0ba3198cf52ee04dd96389eaf985ce36f08cd67d2059d3
Size 45KB
Sample260702-lgs7hsft6v
SHA256 ab6bd14c49ebda993f0ba3198cf52ee04dd96389eaf985ce36f08cd67d2059d3
MD5 527ae8b8211d5cb2495aa55e0b87592a
SHA1 68013fb524fc00c943e092ae58feaf91599d851f
SHA512 5bfd5bcb3b398573f8d75ec989d69ae01e42c39db3761d263b5a49cf5e0137b7ccc5069312568d16f4b6d5d6b7b6ac3e57feb24822c060a01315804140e63589
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q12FpPklON8APIDzjbrgX3iZwuGSOXOUQZRBDZUx:cu6YepTPso2f7kwN8lD3bUXS7GEZvdUx
TLSH
T1CD231A003BE9812BF2BE4F7899F26145467AF6637602D64D1CC441DB4723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xxxtop.net:80
xxxtop.net:22
xxxtop.net:8080
xxxtop.net:8880
xxxtop.net:2052
xxxtop.net:2082
xxxtop.net:2086
xxxtop.net:2095
xxxtop.net:443
xxxtop.net:2053
xxxtop.net:2083
xxxtop.net:2087
xxxtop.net:2096
xxxtop.net:8443
www.xxxtop.net:80
www.xxxtop.net:22
www.xxxtop.net:8080
www.xxxtop.net:8880
www.xxxtop.net:2052
www.xxxtop.net:2082
www.xxxtop.net:2086
www.xxxtop.net:2095
www.xxxtop.net:443
www.xxxtop.net:2053
www.xxxtop.net:2083
www.xxxtop.net:2087
www.xxxtop.net:2096
www.xxxtop.net:8443
notpetya.xxxtop.net:80
notpetya.xxxtop.net:22
notpetya.xxxtop.net:8080
notpetya.xxxtop.net:8880
notpetya.xxxtop.net:2052
notpetya.xxxtop.net:2082
notpetya.xxxtop.net:2086
notpetya.xxxtop.net:2095
notpetya.xxxtop.net:443
notpetya.xxxtop.net:2053
notpetya.xxxtop.net:2083
notpetya.xxxtop.net:2087
notpetya.xxxtop.net:2096
notpetya.xxxtop.net:8443
rat.xxxtop.net:80
rat.xxxtop.net:22
rat.xxxtop.net:8080
rat.xxxtop.net:8880
rat.xxxtop.net:2052
rat.xxxtop.net:2082
rat.xxxtop.net:2086
rat.xxxtop.net:2095
rat.xxxtop.net:443
rat.xxxtop.net:2053
rat.xxxtop.net:2083
rat.xxxtop.net:2087
rat.xxxtop.net:2096
rat.xxxtop.net:8443
ursnif.xxxtop.net:80
ursnif.xxxtop.net:22
ursnif.xxxtop.net:8080
ursnif.xxxtop.net:8880
ursnif.xxxtop.net:2052
ursnif.xxxtop.net:2082
ursnif.xxxtop.net:2086
ursnif.xxxtop.net:2095
ursnif.xxxtop.net:443
ursnif.xxxtop.net:2053
ursnif.xxxtop.net:2083
ursnif.xxxtop.net:2087
ursnif.xxxtop.net:2096
ursnif.xxxtop.net:8443
fakeupdates.xxxtop.net:80
fakeupdates.xxxtop.net:22
fakeupdates.xxxtop.net:8080
fakeupdates.xxxtop.net:8880
fakeupdates.xxxtop.net:2052
fakeupdates.xxxtop.net:2082
fakeupdates.xxxtop.net:2086
fakeupdates.xxxtop.net:2095
fakeupdates.xxxtop.net:443
fakeupdates.xxxtop.net:2053
fakeupdates.xxxtop.net:2083
fakeupdates.xxxtop.net:2087
fakeupdates.xxxtop.net:2096
fakeupdates.xxxtop.net:8443

Mutex

U9kKQ3naK7EG

Attributes

delay
0
install
true
install_file
whrn1ctz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  ab6bd14c49ebda993f0ba3198cf52ee04dd96389eaf985ce36f08cd67d2059d3
- Size 45KB
- SHA256 ab6bd14c49ebda993f0ba3198cf52ee04dd96389eaf985ce36f08cd67d2059d3
- MD5 527ae8b8211d5cb2495aa55e0b87592a
- SHA1 68013fb524fc00c943e092ae58feaf91599d851f
- SHA512 5bfd5bcb3b398573f8d75ec989d69ae01e42c39db3761d263b5a49cf5e0137b7ccc5069312568d16f4b6d5d6b7b6ac3e57feb24822c060a01315804140e63589
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q12FpPklON8APIDzjbrgX3iZwuGSOXOUQZRBDZUx:cu6YepTPso2f7kwN8lD3bUXS7GEZvdUx
- TLSH
  T1CD231A003BE9812BF2BE4F7899F26145467AF6637602D64D1CC441DB4723FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2