asyncrat | 280e942d1c1ab5324ac0db56ea9e34f3f663f5470f37b0fe657238a1a1d9bb14

Sharing

Copy URL Twitter E-mail

General

Target
280e942d1c1ab5324ac0db56ea9e34f3f663f5470f37b0fe657238a1a1d9bb14
Size 45KB
Sample260703-n6c8psgt7t
SHA256 280e942d1c1ab5324ac0db56ea9e34f3f663f5470f37b0fe657238a1a1d9bb14
MD5 409ec96081cc42d64ebef6f1a7404ce2
SHA1 a03389780152a8968af76e72abda2126a5d91fc3
SHA512 de37f45d22b61803b7d138d1c6ca23d40e53fba8c82d6f3b5166ec4b9e6b683dead73b166eebe30c22af4ad66bbf94001b6adc9b24fad1c5b5e86480bd451b61
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9uSEMTFabjOPIM1zjbGgX3CbFl7UkFyfBDZsx:EulCJTHl42B2Q/3M13bZXS5l7updsx
TLSH
T12A231A003BE8812BF2BE5F7899F26145867AF6633603D64D1CC451DB4613FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cuongsex.com:80
cuongsex.com:22
cuongsex.com:8080
cuongsex.com:8880
cuongsex.com:2052
cuongsex.com:2082
cuongsex.com:2086
cuongsex.com:2095
cuongsex.com:443
cuongsex.com:2053
cuongsex.com:2083
cuongsex.com:2087
cuongsex.com:2096
cuongsex.com:8443
www.cuongsex.com:80
www.cuongsex.com:22
www.cuongsex.com:8080
www.cuongsex.com:8880
www.cuongsex.com:2052
www.cuongsex.com:2082
www.cuongsex.com:2086
www.cuongsex.com:2095
www.cuongsex.com:443
www.cuongsex.com:2053
www.cuongsex.com:2083
www.cuongsex.com:2087
www.cuongsex.com:2096
www.cuongsex.com:8443
dridex.cuongsex.com:80
dridex.cuongsex.com:22
dridex.cuongsex.com:8080
dridex.cuongsex.com:8880
dridex.cuongsex.com:2052
dridex.cuongsex.com:2082
dridex.cuongsex.com:2086
dridex.cuongsex.com:2095
dridex.cuongsex.com:443
dridex.cuongsex.com:2053
dridex.cuongsex.com:2083
dridex.cuongsex.com:2087
dridex.cuongsex.com:2096
dridex.cuongsex.com:8443
cl0p.cuongsex.com:80
cl0p.cuongsex.com:22
cl0p.cuongsex.com:8080
cl0p.cuongsex.com:8880
cl0p.cuongsex.com:2052
cl0p.cuongsex.com:2082
cl0p.cuongsex.com:2086
cl0p.cuongsex.com:2095
cl0p.cuongsex.com:443
cl0p.cuongsex.com:2053
cl0p.cuongsex.com:2083
cl0p.cuongsex.com:2087
cl0p.cuongsex.com:2096
cl0p.cuongsex.com:8443
malware.cuongsex.com:80
malware.cuongsex.com:22
malware.cuongsex.com:8080
malware.cuongsex.com:8880
malware.cuongsex.com:2052
malware.cuongsex.com:2082
malware.cuongsex.com:2086
malware.cuongsex.com:2095
malware.cuongsex.com:443
malware.cuongsex.com:2053
malware.cuongsex.com:2083
malware.cuongsex.com:2087
malware.cuongsex.com:2096
malware.cuongsex.com:8443
qbot.cuongsex.com:80
qbot.cuongsex.com:22
qbot.cuongsex.com:8080
qbot.cuongsex.com:8880
qbot.cuongsex.com:2052
qbot.cuongsex.com:2082
qbot.cuongsex.com:2086
qbot.cuongsex.com:2095
qbot.cuongsex.com:443
qbot.cuongsex.com:2053
qbot.cuongsex.com:2083
qbot.cuongsex.com:2087
qbot.cuongsex.com:2096
qbot.cuongsex.com:8443

Mutex

EHsAeosgHyhi

Attributes

delay
0
install
true
install_file
ybny8t.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  280e942d1c1ab5324ac0db56ea9e34f3f663f5470f37b0fe657238a1a1d9bb14
- Size 45KB
- SHA256 280e942d1c1ab5324ac0db56ea9e34f3f663f5470f37b0fe657238a1a1d9bb14
- MD5 409ec96081cc42d64ebef6f1a7404ce2
- SHA1 a03389780152a8968af76e72abda2126a5d91fc3
- SHA512 de37f45d22b61803b7d138d1c6ca23d40e53fba8c82d6f3b5166ec4b9e6b683dead73b166eebe30c22af4ad66bbf94001b6adc9b24fad1c5b5e86480bd451b61
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9uSEMTFabjOPIM1zjbGgX3CbFl7UkFyfBDZsx:EulCJTHl42B2Q/3M13bZXS5l7updsx
- TLSH
  T12A231A003BE8812BF2BE5F7899F26145867AF6633603D64D1CC451DB4613FC69A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2