asyncrat | 6fdb346e1ffddb7a8df058097829c279d2142895fd46fd7d610c516f320bbd1b

Sharing

Copy URL Twitter E-mail

General

Target
6fdb346e1ffddb7a8df058097829c279d2142895fd46fd7d610c516f320bbd1b
Size 45KB
Sample260703-yc3llsft5w
SHA256 6fdb346e1ffddb7a8df058097829c279d2142895fd46fd7d610c516f320bbd1b
MD5 a4ba41ab424dd22eb031fce0f1a30dd3
SHA1 243c0c204dd9e8d1fc2d61e8e9f4f1b24987ee73
SHA512 62275b3e382fa7fe9288d9a9c48fd4106bdc93a0a051b046b87e1a149e4ebd69ac2fbca46ab3ec1f77a677223f0cd613d93d5045513b73bdfe65575ed10aa104
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1w8T0G0zHuPI5zjbGgniiyv3/0GKs2P1BDZUx:cu6YepTPso2JNr353bZitkGFmbdUx
TLSH
T175233B003BE8822BF2BE5FB899F26105827AF6636603D64D1CC451DB5713FC686426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vida-nova-design.com:80
vida-nova-design.com:22
vida-nova-design.com:8080
vida-nova-design.com:8880
vida-nova-design.com:2052
vida-nova-design.com:2082
vida-nova-design.com:2086
vida-nova-design.com:2095
vida-nova-design.com:443
vida-nova-design.com:2053
vida-nova-design.com:2083
vida-nova-design.com:2087
vida-nova-design.com:2096
vida-nova-design.com:8443
www.vida-nova-design.com:80
www.vida-nova-design.com:22
www.vida-nova-design.com:8080
www.vida-nova-design.com:8880
www.vida-nova-design.com:2052
www.vida-nova-design.com:2082
www.vida-nova-design.com:2086
www.vida-nova-design.com:2095
www.vida-nova-design.com:443
www.vida-nova-design.com:2053
www.vida-nova-design.com:2083
www.vida-nova-design.com:2087
www.vida-nova-design.com:2096
www.vida-nova-design.com:8443
triton.vida-nova-design.com:80
triton.vida-nova-design.com:22
triton.vida-nova-design.com:8080
triton.vida-nova-design.com:8880
triton.vida-nova-design.com:2052
triton.vida-nova-design.com:2082
triton.vida-nova-design.com:2086
triton.vida-nova-design.com:2095
triton.vida-nova-design.com:443
triton.vida-nova-design.com:2053
triton.vida-nova-design.com:2083
triton.vida-nova-design.com:2087
triton.vida-nova-design.com:2096
triton.vida-nova-design.com:8443
connect.vida-nova-design.com:80
connect.vida-nova-design.com:22
connect.vida-nova-design.com:8080
connect.vida-nova-design.com:8880
connect.vida-nova-design.com:2052
connect.vida-nova-design.com:2082
connect.vida-nova-design.com:2086
connect.vida-nova-design.com:2095
connect.vida-nova-design.com:443
connect.vida-nova-design.com:2053
connect.vida-nova-design.com:2083
connect.vida-nova-design.com:2087
connect.vida-nova-design.com:2096
connect.vida-nova-design.com:8443

Mutex

sppfZGr4zZD9

Attributes

delay
0
install
true
install_file
nsk117on.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6fdb346e1ffddb7a8df058097829c279d2142895fd46fd7d610c516f320bbd1b
- Size 45KB
- SHA256 6fdb346e1ffddb7a8df058097829c279d2142895fd46fd7d610c516f320bbd1b
- MD5 a4ba41ab424dd22eb031fce0f1a30dd3
- SHA1 243c0c204dd9e8d1fc2d61e8e9f4f1b24987ee73
- SHA512 62275b3e382fa7fe9288d9a9c48fd4106bdc93a0a051b046b87e1a149e4ebd69ac2fbca46ab3ec1f77a677223f0cd613d93d5045513b73bdfe65575ed10aa104
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1w8T0G0zHuPI5zjbGgniiyv3/0GKs2P1BDZUx:cu6YepTPso2JNr353bZitkGFmbdUx
- TLSH
  T175233B003BE8822BF2BE5FB899F26105827AF6636603D64D1CC451DB5713FC686426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2