asyncrat | d2c03298554723b0a81db9e3220ca23896f9238379cc567771e87c86e348293c

Sharing

Copy URL Twitter E-mail

General

Target
d2c03298554723b0a81db9e3220ca23896f9238379cc567771e87c86e348293c
Size 45KB
Sample260703-k7abnabs8k
SHA256 d2c03298554723b0a81db9e3220ca23896f9238379cc567771e87c86e348293c
MD5 c84684663b3398b075a15af3e85d8877
SHA1 8e42da6471b4641bf7fe36763046b5a436e844cb
SHA512 414b570b23050c9319688b1fcfee9144aed1ad738c6826e0c0013fc66fa1268958aac38b23b0f322e4bf740bb6a06a290968493a9a5d928fc7f28cc1abdf86ee
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1PFaPklZL3APIRzjb3gX3iPrUyYta7NV7Q1BDZUx:cu6YepTPso2GEkfL3lR3bQXSPrUyYtab
TLSH
T1C3230A0037E8812BF2BE4F78ADF26146867AF6636603D6491CC451DB4723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cuongsex.com:80
cuongsex.com:22
cuongsex.com:8080
cuongsex.com:8880
cuongsex.com:2052
cuongsex.com:2082
cuongsex.com:2086
cuongsex.com:2095
cuongsex.com:443
cuongsex.com:2053
cuongsex.com:2083
cuongsex.com:2087
cuongsex.com:2096
cuongsex.com:8443
www.cuongsex.com:80
www.cuongsex.com:22
www.cuongsex.com:8080
www.cuongsex.com:8880
www.cuongsex.com:2052
www.cuongsex.com:2082
www.cuongsex.com:2086
www.cuongsex.com:2095
www.cuongsex.com:443
www.cuongsex.com:2053
www.cuongsex.com:2083
www.cuongsex.com:2087
www.cuongsex.com:2096
www.cuongsex.com:8443
dridex.cuongsex.com:80
dridex.cuongsex.com:22
dridex.cuongsex.com:8080
dridex.cuongsex.com:8880
dridex.cuongsex.com:2052
dridex.cuongsex.com:2082
dridex.cuongsex.com:2086
dridex.cuongsex.com:2095
dridex.cuongsex.com:443
dridex.cuongsex.com:2053
dridex.cuongsex.com:2083
dridex.cuongsex.com:2087
dridex.cuongsex.com:2096
dridex.cuongsex.com:8443
hermeticwiper.cuongsex.com:80
hermeticwiper.cuongsex.com:22
hermeticwiper.cuongsex.com:8080
hermeticwiper.cuongsex.com:8880
hermeticwiper.cuongsex.com:2052
hermeticwiper.cuongsex.com:2082
hermeticwiper.cuongsex.com:2086
hermeticwiper.cuongsex.com:2095
hermeticwiper.cuongsex.com:443
hermeticwiper.cuongsex.com:2053
hermeticwiper.cuongsex.com:2083
hermeticwiper.cuongsex.com:2087
hermeticwiper.cuongsex.com:2096
hermeticwiper.cuongsex.com:8443
gootloader.cuongsex.com:80
gootloader.cuongsex.com:22
gootloader.cuongsex.com:8080
gootloader.cuongsex.com:8880
gootloader.cuongsex.com:2052
gootloader.cuongsex.com:2082
gootloader.cuongsex.com:2086
gootloader.cuongsex.com:2095
gootloader.cuongsex.com:443
gootloader.cuongsex.com:2053
gootloader.cuongsex.com:2083
gootloader.cuongsex.com:2087
gootloader.cuongsex.com:2096
gootloader.cuongsex.com:8443

Mutex

NFMuDW5nL4V3

Attributes

delay
0
install
true
install_file
kejvysfy.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  d2c03298554723b0a81db9e3220ca23896f9238379cc567771e87c86e348293c
- Size 45KB
- SHA256 d2c03298554723b0a81db9e3220ca23896f9238379cc567771e87c86e348293c
- MD5 c84684663b3398b075a15af3e85d8877
- SHA1 8e42da6471b4641bf7fe36763046b5a436e844cb
- SHA512 414b570b23050c9319688b1fcfee9144aed1ad738c6826e0c0013fc66fa1268958aac38b23b0f322e4bf740bb6a06a290968493a9a5d928fc7f28cc1abdf86ee
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1PFaPklZL3APIRzjb3gX3iPrUyYta7NV7Q1BDZUx:cu6YepTPso2GEkfL3lR3bQXSPrUyYtab
- TLSH
  T1C3230A0037E8812BF2BE4F78ADF26146867AF6636603D6491CC451DB4723FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2