asyncrat | 5e380eb50629c43a77fa77fdcd32c1aa5f933fa1430e5508b316c4137ea3d9e1

Sharing

Copy URL Twitter E-mail

General

Target
5e380eb50629c43a77fa77fdcd32c1aa5f933fa1430e5508b316c4137ea3d9e1
Size 45KB
Sample260703-m4rsmsfx9s
SHA256 5e380eb50629c43a77fa77fdcd32c1aa5f933fa1430e5508b316c4137ea3d9e1
MD5 dc0e3f1ddc42e901ae20862be7d937a8
SHA1 3b0c4c73ea55eb5d9d119c86af7e8221649b0d58
SHA512 f79074a6a4db7a2cf5c396dc22677a06a5746d85652206cbdb21169dc7d81d49676eb43a44381c1d67ec4b12d374f9cb5696a43fcc2b8f238df90162cb2dd2d8
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAOGsGx8OHuPI2zjbIgl3igF5IlL2Mx/ToBDZcx:UuKWgSJTwRf2eez323bflSgwlLrTOdcx
TLSH
T120232B0037E8812BF2BE4FB868F26145467AF1737603D5892CC452DB5623FC6CA426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cuongsex.com:80
cuongsex.com:22
cuongsex.com:8080
cuongsex.com:8880
cuongsex.com:2052
cuongsex.com:2082
cuongsex.com:2086
cuongsex.com:2095
cuongsex.com:443
cuongsex.com:2053
cuongsex.com:2083
cuongsex.com:2087
cuongsex.com:2096
cuongsex.com:8443
www.cuongsex.com:80
www.cuongsex.com:22
www.cuongsex.com:8080
www.cuongsex.com:8880
www.cuongsex.com:2052
www.cuongsex.com:2082
www.cuongsex.com:2086
www.cuongsex.com:2095
www.cuongsex.com:443
www.cuongsex.com:2053
www.cuongsex.com:2083
www.cuongsex.com:2087
www.cuongsex.com:2096
www.cuongsex.com:8443
hack.cuongsex.com:80
hack.cuongsex.com:22
hack.cuongsex.com:8080
hack.cuongsex.com:8880
hack.cuongsex.com:2052
hack.cuongsex.com:2082
hack.cuongsex.com:2086
hack.cuongsex.com:2095
hack.cuongsex.com:443
hack.cuongsex.com:2053
hack.cuongsex.com:2083
hack.cuongsex.com:2087
hack.cuongsex.com:2096
hack.cuongsex.com:8443
malware.cuongsex.com:80
malware.cuongsex.com:22
malware.cuongsex.com:8080
malware.cuongsex.com:8880
malware.cuongsex.com:2052
malware.cuongsex.com:2082
malware.cuongsex.com:2086
malware.cuongsex.com:2095
malware.cuongsex.com:443
malware.cuongsex.com:2053
malware.cuongsex.com:2083
malware.cuongsex.com:2087
malware.cuongsex.com:2096
malware.cuongsex.com:8443
socgholish.cuongsex.com:80
socgholish.cuongsex.com:22
socgholish.cuongsex.com:8080
socgholish.cuongsex.com:8880
socgholish.cuongsex.com:2052
socgholish.cuongsex.com:2082
socgholish.cuongsex.com:2086
socgholish.cuongsex.com:2095
socgholish.cuongsex.com:443
socgholish.cuongsex.com:2053
socgholish.cuongsex.com:2083
socgholish.cuongsex.com:2087
socgholish.cuongsex.com:2096
socgholish.cuongsex.com:8443
downadup.cuongsex.com:80
downadup.cuongsex.com:22
downadup.cuongsex.com:8080
downadup.cuongsex.com:8880
downadup.cuongsex.com:2052
downadup.cuongsex.com:2082
downadup.cuongsex.com:2086
downadup.cuongsex.com:2095
downadup.cuongsex.com:443
downadup.cuongsex.com:2053
downadup.cuongsex.com:2083
downadup.cuongsex.com:2087
downadup.cuongsex.com:2096
downadup.cuongsex.com:8443

Mutex

JjAyynfu2Nsf

Attributes

delay
0
install
true
install_file
mgl7j8vg.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5e380eb50629c43a77fa77fdcd32c1aa5f933fa1430e5508b316c4137ea3d9e1
- Size 45KB
- SHA256 5e380eb50629c43a77fa77fdcd32c1aa5f933fa1430e5508b316c4137ea3d9e1
- MD5 dc0e3f1ddc42e901ae20862be7d937a8
- SHA1 3b0c4c73ea55eb5d9d119c86af7e8221649b0d58
- SHA512 f79074a6a4db7a2cf5c396dc22677a06a5746d85652206cbdb21169dc7d81d49676eb43a44381c1d67ec4b12d374f9cb5696a43fcc2b8f238df90162cb2dd2d8
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAOGsGx8OHuPI2zjbIgl3igF5IlL2Mx/ToBDZcx:UuKWgSJTwRf2eez323bflSgwlLrTOdcx
- TLSH
  T120232B0037E8812BF2BE4FB868F26145467AF1737603D5892CC452DB5623FC6CA426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2