asyncrat | aa1f25b4917e9a86639c176f2bd28448308952aff9d039a2b6bbd30803923bf5

Sharing

Copy URL Twitter E-mail

General

Target
aa1f25b4917e9a86639c176f2bd28448308952aff9d039a2b6bbd30803923bf5
Size 45KB
Sample260703-lbw18aev5t
SHA256 aa1f25b4917e9a86639c176f2bd28448308952aff9d039a2b6bbd30803923bf5
MD5 f860c0ef674a2db7b1616bb8652fb110
SHA1 55b0ba5b84f3fe71e3e4ae724a7a83e12c1559a5
SHA512 a931db1ca1f6ca5a7dfc6507ff2eba3fa51fb31a0d46039425ca0fe0e119bf688720f52db5f179f004732c2682310624f68d0525b9e7c7eac2e92869db6c6f75
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHNd3u40cMOPI08zjbJgX+ieBVzxfE91i2yBDZEx:MuLAZTnbg2Y8+M3083bGXHejtkw2MdEx
TLSH
T1AC232A003BE8812BF2BE4F78ADF26145867AF2637603D54E1CC4519B5613FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cuongsex.com:80
cuongsex.com:22
cuongsex.com:8080
cuongsex.com:8880
cuongsex.com:2052
cuongsex.com:2082
cuongsex.com:2086
cuongsex.com:2095
cuongsex.com:443
cuongsex.com:2053
cuongsex.com:2083
cuongsex.com:2087
cuongsex.com:2096
cuongsex.com:8443
www.cuongsex.com:80
www.cuongsex.com:22
www.cuongsex.com:8080
www.cuongsex.com:8880
www.cuongsex.com:2052
www.cuongsex.com:2082
www.cuongsex.com:2086
www.cuongsex.com:2095
www.cuongsex.com:443
www.cuongsex.com:2053
www.cuongsex.com:2083
www.cuongsex.com:2087
www.cuongsex.com:2096
www.cuongsex.com:8443
dridex.cuongsex.com:80
dridex.cuongsex.com:22
dridex.cuongsex.com:8080
dridex.cuongsex.com:8880
dridex.cuongsex.com:2052
dridex.cuongsex.com:2082
dridex.cuongsex.com:2086
dridex.cuongsex.com:2095
dridex.cuongsex.com:443
dridex.cuongsex.com:2053
dridex.cuongsex.com:2083
dridex.cuongsex.com:2087
dridex.cuongsex.com:2096
dridex.cuongsex.com:8443
formbook.cuongsex.com:80
formbook.cuongsex.com:22
formbook.cuongsex.com:8080
formbook.cuongsex.com:8880
formbook.cuongsex.com:2052
formbook.cuongsex.com:2082
formbook.cuongsex.com:2086
formbook.cuongsex.com:2095
formbook.cuongsex.com:443
formbook.cuongsex.com:2053
formbook.cuongsex.com:2083
formbook.cuongsex.com:2087
formbook.cuongsex.com:2096
formbook.cuongsex.com:8443
mirai.cuongsex.com:80
mirai.cuongsex.com:22
mirai.cuongsex.com:8080
mirai.cuongsex.com:8880
mirai.cuongsex.com:2052
mirai.cuongsex.com:2082
mirai.cuongsex.com:2086
mirai.cuongsex.com:2095
mirai.cuongsex.com:443
mirai.cuongsex.com:2053
mirai.cuongsex.com:2083
mirai.cuongsex.com:2087
mirai.cuongsex.com:2096
mirai.cuongsex.com:8443
ryuk.cuongsex.com:80
ryuk.cuongsex.com:22
ryuk.cuongsex.com:8080
ryuk.cuongsex.com:8880
ryuk.cuongsex.com:2052
ryuk.cuongsex.com:2082
ryuk.cuongsex.com:2086
ryuk.cuongsex.com:2095
ryuk.cuongsex.com:443
ryuk.cuongsex.com:2053
ryuk.cuongsex.com:2083
ryuk.cuongsex.com:2087
ryuk.cuongsex.com:2096
ryuk.cuongsex.com:8443

Mutex

xRnoWjZ8r4jh

Attributes

delay
0
install
true
install_file
jj2bq.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  aa1f25b4917e9a86639c176f2bd28448308952aff9d039a2b6bbd30803923bf5
- Size 45KB
- SHA256 aa1f25b4917e9a86639c176f2bd28448308952aff9d039a2b6bbd30803923bf5
- MD5 f860c0ef674a2db7b1616bb8652fb110
- SHA1 55b0ba5b84f3fe71e3e4ae724a7a83e12c1559a5
- SHA512 a931db1ca1f6ca5a7dfc6507ff2eba3fa51fb31a0d46039425ca0fe0e119bf688720f52db5f179f004732c2682310624f68d0525b9e7c7eac2e92869db6c6f75
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHNd3u40cMOPI08zjbJgX+ieBVzxfE91i2yBDZEx:MuLAZTnbg2Y8+M3083bGXHejtkw2MdEx
- TLSH
  T1AC232A003BE8812BF2BE4F78ADF26145867AF2637603D54E1CC4519B5613FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2