asyncrat | 4385e2797fc99d3594a68a6917ca05490698b5007ab6bc79e962380574d03ab6

Sharing

Copy URL Twitter E-mail

General

Target
4385e2797fc99d3594a68a6917ca05490698b5007ab6bc79e962380574d03ab6
Size 45KB
Sample260703-rdlk6afw5p
SHA256 4385e2797fc99d3594a68a6917ca05490698b5007ab6bc79e962380574d03ab6
MD5 afd481cbc40297fc9d209e75c7aef905
SHA1 a399b3babd0bd9d1acc3e095693823c8f9f818e8
SHA512 32dc096d8f97a8c60c13fa8a821f30ded950b344cbc12d1bce588936b745e609d64703973030066bcec3a2633144f23af0cc0f6a21ec4c60de23c46252f9dac0
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3xY6AZOOPILzjbdgm3iyo90WMadjtBDZEx:MuLAZTnbg2RulO3L3bKmSyo90wdjjdEx
TLSH
T183233C103BE8C12BF2BE4F78A8F26105867AF6A36603D69D1CC451DB4713BC696426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cuongsex.com:80
cuongsex.com:22
cuongsex.com:8080
cuongsex.com:8880
cuongsex.com:2052
cuongsex.com:2082
cuongsex.com:2086
cuongsex.com:2095
cuongsex.com:443
cuongsex.com:2053
cuongsex.com:2083
cuongsex.com:2087
cuongsex.com:2096
cuongsex.com:8443
www.cuongsex.com:80
www.cuongsex.com:22
www.cuongsex.com:8080
www.cuongsex.com:8880
www.cuongsex.com:2052
www.cuongsex.com:2082
www.cuongsex.com:2086
www.cuongsex.com:2095
www.cuongsex.com:443
www.cuongsex.com:2053
www.cuongsex.com:2083
www.cuongsex.com:2087
www.cuongsex.com:2096
www.cuongsex.com:8443
hack.cuongsex.com:80
hack.cuongsex.com:22
hack.cuongsex.com:8080
hack.cuongsex.com:8880
hack.cuongsex.com:2052
hack.cuongsex.com:2082
hack.cuongsex.com:2086
hack.cuongsex.com:2095
hack.cuongsex.com:443
hack.cuongsex.com:2053
hack.cuongsex.com:2083
hack.cuongsex.com:2087
hack.cuongsex.com:2096
hack.cuongsex.com:8443
melissa.cuongsex.com:80
melissa.cuongsex.com:22
melissa.cuongsex.com:8080
melissa.cuongsex.com:8880
melissa.cuongsex.com:2052
melissa.cuongsex.com:2082
melissa.cuongsex.com:2086
melissa.cuongsex.com:2095
melissa.cuongsex.com:443
melissa.cuongsex.com:2053
melissa.cuongsex.com:2083
melissa.cuongsex.com:2087
melissa.cuongsex.com:2096
melissa.cuongsex.com:8443
remcos.cuongsex.com:80
remcos.cuongsex.com:22
remcos.cuongsex.com:8080
remcos.cuongsex.com:8880
remcos.cuongsex.com:2052
remcos.cuongsex.com:2082
remcos.cuongsex.com:2086
remcos.cuongsex.com:2095
remcos.cuongsex.com:443
remcos.cuongsex.com:2053
remcos.cuongsex.com:2083
remcos.cuongsex.com:2087
remcos.cuongsex.com:2096
remcos.cuongsex.com:8443
ryuk.cuongsex.com:80
ryuk.cuongsex.com:22
ryuk.cuongsex.com:8080
ryuk.cuongsex.com:8880
ryuk.cuongsex.com:2052
ryuk.cuongsex.com:2082
ryuk.cuongsex.com:2086
ryuk.cuongsex.com:2095
ryuk.cuongsex.com:443
ryuk.cuongsex.com:2053
ryuk.cuongsex.com:2083
ryuk.cuongsex.com:2087
ryuk.cuongsex.com:2096
ryuk.cuongsex.com:8443

Mutex

hIR46gKlFVDQ

Attributes

delay
0
install
true
install_file
k9yak.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4385e2797fc99d3594a68a6917ca05490698b5007ab6bc79e962380574d03ab6
- Size 45KB
- SHA256 4385e2797fc99d3594a68a6917ca05490698b5007ab6bc79e962380574d03ab6
- MD5 afd481cbc40297fc9d209e75c7aef905
- SHA1 a399b3babd0bd9d1acc3e095693823c8f9f818e8
- SHA512 32dc096d8f97a8c60c13fa8a821f30ded950b344cbc12d1bce588936b745e609d64703973030066bcec3a2633144f23af0cc0f6a21ec4c60de23c46252f9dac0
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3xY6AZOOPILzjbdgm3iyo90WMadjtBDZEx:MuLAZTnbg2RulO3L3bKmSyo90wdjjdEx
- TLSH
  T183233C103BE8C12BF2BE4F78A8F26105867AF6A36603D69D1CC451DB4713BC696426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2