asyncrat | c6126ffacb6270dfcb2d1b1c8b49c3b2ebd5f9f0d5e609e908f34c6f1df5af94

Sharing

Copy URL Twitter E-mail

General

Target
c6126ffacb6270dfcb2d1b1c8b49c3b2ebd5f9f0d5e609e908f34c6f1df5af94
Size 45KB
Sample260703-k29jkabs2r
SHA256 c6126ffacb6270dfcb2d1b1c8b49c3b2ebd5f9f0d5e609e908f34c6f1df5af94
MD5 10fddece037fd8c9776c5bfd8280e440
SHA1 7df8b35457ac9ab818b66c2e2a8dcb1f78415804
SHA512 081df8be55caf574fa6e6b90df0d88c00beda0b7aebab6ec873ea2c15e9d4612cde03d1f5f492e85cae81ddbfffd81ca3093e3fd07905bb4890bbb8f849430d8
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBqj2OPI/pzjbBgX3ina1aQTCvhuNoBDZsx:EulCJTHl42IyoK3/p3buXSa1Dkh3dsx
TLSH
T169230A003BE9C13BF27E4F78A9F26145867AF6633603E64D1CC451975623FC68A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

ncivps.org:80
ncivps.org:22
ncivps.org:8080
ncivps.org:8880
ncivps.org:2052
ncivps.org:2082
ncivps.org:2086
ncivps.org:2095
ncivps.org:443
ncivps.org:2053
ncivps.org:2083
ncivps.org:2087
ncivps.org:2096
ncivps.org:8443
www.ncivps.org:80
www.ncivps.org:22
www.ncivps.org:8080
www.ncivps.org:8880
www.ncivps.org:2052
www.ncivps.org:2082
www.ncivps.org:2086
www.ncivps.org:2095
www.ncivps.org:443
www.ncivps.org:2053
www.ncivps.org:2083
www.ncivps.org:2087
www.ncivps.org:2096
www.ncivps.org:8443
zeus.ncivps.org:80
zeus.ncivps.org:22
zeus.ncivps.org:8080
zeus.ncivps.org:8880
zeus.ncivps.org:2052
zeus.ncivps.org:2082
zeus.ncivps.org:2086
zeus.ncivps.org:2095
zeus.ncivps.org:443
zeus.ncivps.org:2053
zeus.ncivps.org:2083
zeus.ncivps.org:2087
zeus.ncivps.org:2096
zeus.ncivps.org:8443
hermeticwiper.ncivps.org:80
hermeticwiper.ncivps.org:22
hermeticwiper.ncivps.org:8080
hermeticwiper.ncivps.org:8880
hermeticwiper.ncivps.org:2052
hermeticwiper.ncivps.org:2082
hermeticwiper.ncivps.org:2086
hermeticwiper.ncivps.org:2095
hermeticwiper.ncivps.org:443
hermeticwiper.ncivps.org:2053
hermeticwiper.ncivps.org:2083
hermeticwiper.ncivps.org:2087
hermeticwiper.ncivps.org:2096
hermeticwiper.ncivps.org:8443
melissa.ncivps.org:80
melissa.ncivps.org:22
melissa.ncivps.org:8080
melissa.ncivps.org:8880
melissa.ncivps.org:2052
melissa.ncivps.org:2082
melissa.ncivps.org:2086
melissa.ncivps.org:2095
melissa.ncivps.org:443
melissa.ncivps.org:2053
melissa.ncivps.org:2083
melissa.ncivps.org:2087
melissa.ncivps.org:2096
melissa.ncivps.org:8443
trickbot.ncivps.org:80
trickbot.ncivps.org:22
trickbot.ncivps.org:8080
trickbot.ncivps.org:8880
trickbot.ncivps.org:2052
trickbot.ncivps.org:2082
trickbot.ncivps.org:2086
trickbot.ncivps.org:2095
trickbot.ncivps.org:443
trickbot.ncivps.org:2053
trickbot.ncivps.org:2083
trickbot.ncivps.org:2087
trickbot.ncivps.org:2096
trickbot.ncivps.org:8443

Mutex

K4ccIyxV4Zes

Attributes

delay
0
install
true
install_file
aw1mfu.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c6126ffacb6270dfcb2d1b1c8b49c3b2ebd5f9f0d5e609e908f34c6f1df5af94
- Size 45KB
- SHA256 c6126ffacb6270dfcb2d1b1c8b49c3b2ebd5f9f0d5e609e908f34c6f1df5af94
- MD5 10fddece037fd8c9776c5bfd8280e440
- SHA1 7df8b35457ac9ab818b66c2e2a8dcb1f78415804
- SHA512 081df8be55caf574fa6e6b90df0d88c00beda0b7aebab6ec873ea2c15e9d4612cde03d1f5f492e85cae81ddbfffd81ca3093e3fd07905bb4890bbb8f849430d8
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBqj2OPI/pzjbBgX3ina1aQTCvhuNoBDZsx:EulCJTHl42IyoK3/p3buXSa1Dkh3dsx
- TLSH
  T169230A003BE9C13BF27E4F78A9F26145867AF6633603E64D1CC451975623FC68A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2