asyncrat | 6325456a357e575cec9833a14592834380fcc2c60ec1b1a365018d0c60a0e9d3

Sharing

Copy URL Twitter E-mail

General

Target
6325456a357e575cec9833a14592834380fcc2c60ec1b1a365018d0c60a0e9d3.exe
Size 407KB
Sample260703-bpdfxsev4n
SHA256 6325456a357e575cec9833a14592834380fcc2c60ec1b1a365018d0c60a0e9d3
MD5 0ea4af2268c7a94f3d384515fd11dd4f
SHA1 753652605147603b10a30bde53621e77120bd725
SHA512 77316686eba5b1c042e43bda5f51f163e81ac901c8d4a5d327c919c90694d096331ab51efcae6f0e5cb4ae383b13a478b921ef2ba1670ef541aa59293f181de2
SSDEEP 1536:uuqKpTTWJ29/cUsOU43beXSGN78VSdmuxwo4uxg/uSx1:uuqiTTWJ29kUpU43be11C9uD81
TLSH
T18D94A32037E4F02AE5AE5A759F96F0B412757D562E42C65238CC73CF353EE8188393A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

viet69.vg:443
viet69.vg:80
viet69.vg:53
viet69.vg:43
viet69.vg:8888
viet69.vg:8080
cdn.viet69.vg:443
cdn.viet69.vg:80
cdn.viet69.vg:53
cdn.viet69.vg:43
cdn.viet69.vg:8888
cdn.viet69.vg:8080
img.viet69.vg:443
img.viet69.vg:80
img.viet69.vg:53
img.viet69.vg:43
img.viet69.vg:8888
img.viet69.vg:8080
www.viet69.vg:443
www.viet69.vg:80
www.viet69.vg:53
www.viet69.vg:43
www.viet69.vg:8888
www.viet69.vg:8080
sextop1.cafe:443
sextop1.cafe:80
sextop1.cafe:53
sextop1.cafe:43
sextop1.cafe:8888
sextop1.cafe:8080
admin.sextop1.cafe:443
admin.sextop1.cafe:80
admin.sextop1.cafe:53
admin.sextop1.cafe:43
admin.sextop1.cafe:8888
admin.sextop1.cafe:8080
backend.sextop1.cafe:443
backend.sextop1.cafe:80
backend.sextop1.cafe:53
backend.sextop1.cafe:43
backend.sextop1.cafe:8888
backend.sextop1.cafe:8080
dev.sextop1.cafe:443
dev.sextop1.cafe:80
dev.sextop1.cafe:53
dev.sextop1.cafe:43
dev.sextop1.cafe:8888
dev.sextop1.cafe:8080
af88.life:443
af88.life:80
af88.life:53
af88.life:43
af88.life:8888
af88.life:8080
172.67.177.99:443
172.67.177.99:80
172.67.177.99:53
172.67.177.99:43
172.67.177.99:8888
172.67.177.99:8080
104.21.51.79:443
104.21.51.79:80
104.21.51.79:53
104.21.51.79:43
104.21.51.79:8888
104.21.51.79:8080
94.154.172.236:443
94.154.172.236:80
94.154.172.236:53
94.154.172.236:43
94.154.172.236:8888
94.154.172.236:8080
199.59.243.226:443
199.59.243.226:80
199.59.243.226:53
199.59.243.226:43
199.59.243.226:8888
199.59.243.226:8080
91.195.240.123:443
91.195.240.123:80
91.195.240.123:53
91.195.240.123:43
91.195.240.123:8888
91.195.240.123:8080
198.54.117.215:443
198.54.117.215:80
198.54.117.215:53
198.54.117.215:43
198.54.117.215:8888
198.54.117.215:8080

Mutex

SbWU4voLVPfv

Attributes

delay
3
install
true
install_file
dev.exe
install_folder
%Temp%

aes.plain

Targets

- Target
  6325456a357e575cec9833a14592834380fcc2c60ec1b1a365018d0c60a0e9d3.exe
- Size 407KB
- SHA256 6325456a357e575cec9833a14592834380fcc2c60ec1b1a365018d0c60a0e9d3
- MD5 0ea4af2268c7a94f3d384515fd11dd4f
- SHA1 753652605147603b10a30bde53621e77120bd725
- SHA512 77316686eba5b1c042e43bda5f51f163e81ac901c8d4a5d327c919c90694d096331ab51efcae6f0e5cb4ae383b13a478b921ef2ba1670ef541aa59293f181de2
- SSDEEP 1536:uuqKpTTWJ29/cUsOU43beXSGN78VSdmuxwo4uxg/uSx1:uuqiTTWJ29kUpU43be11C9uD81
- TLSH
  T18D94A32037E4F02AE5AE5A759F96F0B412757D562E42C65238CC73CF353EE8188393A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

dev defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2