asyncrat | 698af567bb757a4acd0d96218ad0009ae7964f7a0e69183ca3c8c0f5c0a80228

Sharing

Copy URL Twitter E-mail

General

Target
698af567bb757a4acd0d96218ad0009ae7964f7a0e69183ca3c8c0f5c0a80228
Size 45KB
Sample260703-k2v16sbs2p
SHA256 698af567bb757a4acd0d96218ad0009ae7964f7a0e69183ca3c8c0f5c0a80228
MD5 00a3650340544a3edba630273ceee97f
SHA1 4e93180955b4a70d2b27483702d155d70e4a9b86
SHA512 770073d4b53424c87bbd2e2c272e286c6df326ec14a484609708e5f934dcaa533bbb8651c9028c850757bf573b770405b65862cc0250cd5534b6ccc621503a73
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4j9Yq3q3hOPI2zjbygX3iWoOq//QzUUBDZ0x:8uUIpT4vAj2naCq323b1XSWoVad0x
TLSH
T13C232A003BE9C12BF2BF4FB89CF26145867AF5633603D64A1CC4529B5613BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cuongsex.com:80
cuongsex.com:22
cuongsex.com:8080
cuongsex.com:8880
cuongsex.com:2052
cuongsex.com:2082
cuongsex.com:2086
cuongsex.com:2095
cuongsex.com:443
cuongsex.com:2053
cuongsex.com:2083
cuongsex.com:2087
cuongsex.com:2096
cuongsex.com:8443
www.cuongsex.com:80
www.cuongsex.com:22
www.cuongsex.com:8080
www.cuongsex.com:8880
www.cuongsex.com:2052
www.cuongsex.com:2082
www.cuongsex.com:2086
www.cuongsex.com:2095
www.cuongsex.com:443
www.cuongsex.com:2053
www.cuongsex.com:2083
www.cuongsex.com:2087
www.cuongsex.com:2096
www.cuongsex.com:8443
conficker.cuongsex.com:80
conficker.cuongsex.com:22
conficker.cuongsex.com:8080
conficker.cuongsex.com:8880
conficker.cuongsex.com:2052
conficker.cuongsex.com:2082
conficker.cuongsex.com:2086
conficker.cuongsex.com:2095
conficker.cuongsex.com:443
conficker.cuongsex.com:2053
conficker.cuongsex.com:2083
conficker.cuongsex.com:2087
conficker.cuongsex.com:2096
conficker.cuongsex.com:8443
lokibot.cuongsex.com:80
lokibot.cuongsex.com:22
lokibot.cuongsex.com:8080
lokibot.cuongsex.com:8880
lokibot.cuongsex.com:2052
lokibot.cuongsex.com:2082
lokibot.cuongsex.com:2086
lokibot.cuongsex.com:2095
lokibot.cuongsex.com:443
lokibot.cuongsex.com:2053
lokibot.cuongsex.com:2083
lokibot.cuongsex.com:2087
lokibot.cuongsex.com:2096
lokibot.cuongsex.com:8443
invasive.cuongsex.com:80
invasive.cuongsex.com:22
invasive.cuongsex.com:8080
invasive.cuongsex.com:8880
invasive.cuongsex.com:2052
invasive.cuongsex.com:2082
invasive.cuongsex.com:2086
invasive.cuongsex.com:2095
invasive.cuongsex.com:443
invasive.cuongsex.com:2053
invasive.cuongsex.com:2083
invasive.cuongsex.com:2087
invasive.cuongsex.com:2096
invasive.cuongsex.com:8443
remcos.cuongsex.com:80
remcos.cuongsex.com:22
remcos.cuongsex.com:8080
remcos.cuongsex.com:8880
remcos.cuongsex.com:2052
remcos.cuongsex.com:2082
remcos.cuongsex.com:2086
remcos.cuongsex.com:2095
remcos.cuongsex.com:443
remcos.cuongsex.com:2053
remcos.cuongsex.com:2083
remcos.cuongsex.com:2087
remcos.cuongsex.com:2096
remcos.cuongsex.com:8443

Mutex

dBueQSrJnFlT

Attributes

delay
0
install
true
install_file
ng6kjaf.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  698af567bb757a4acd0d96218ad0009ae7964f7a0e69183ca3c8c0f5c0a80228
- Size 45KB
- SHA256 698af567bb757a4acd0d96218ad0009ae7964f7a0e69183ca3c8c0f5c0a80228
- MD5 00a3650340544a3edba630273ceee97f
- SHA1 4e93180955b4a70d2b27483702d155d70e4a9b86
- SHA512 770073d4b53424c87bbd2e2c272e286c6df326ec14a484609708e5f934dcaa533bbb8651c9028c850757bf573b770405b65862cc0250cd5534b6ccc621503a73
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4j9Yq3q3hOPI2zjbygX3iWoOq//QzUUBDZ0x:8uUIpT4vAj2naCq323b1XSWoVad0x
- TLSH
  T13C232A003BE9C12BF2BF4FB89CF26145867AF5633603D64A1CC4529B5613BC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2