asyncrat | f160577708f3e0116949aafd696972ca8c9d14afa502ce8daaa1676305285a2c

Sharing

Copy URL Twitter E-mail

General

Target
f160577708f3e0116949aafd696972ca8c9d14afa502ce8daaa1676305285a2c
Size 45KB
Sample260703-yn1ldsfv4w
SHA256 f160577708f3e0116949aafd696972ca8c9d14afa502ce8daaa1676305285a2c
MD5 6a6b1501eb7bf78047c97c64353c6141
SHA1 2952968f77293ed6f60f724eca6c0fe0dd5cf4ae
SHA512 776beb4929be6770805c3e864a816de13f7794697f634dfce34f30dd4361508c49657c0e93539b9ad05ff7501875b4cfa2a1776f8847cec90f7aa67110e43d97
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0yFjrdjYkk8PIucjbrgX3iVga5L1/8YC3tWBE:MuBGJTPho2/LBXQBusbUXSVv5LCYyGdG
TLSH
T1C2231B0037E9812BF2BE4F7499F26245867AF6733603D54A1CC441DB5B13BC69A43AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cuongsex.com:80
cuongsex.com:22
cuongsex.com:8080
cuongsex.com:8880
cuongsex.com:2052
cuongsex.com:2082
cuongsex.com:2086
cuongsex.com:2095
cuongsex.com:443
cuongsex.com:2053
cuongsex.com:2083
cuongsex.com:2087
cuongsex.com:2096
cuongsex.com:8443
www.cuongsex.com:80
www.cuongsex.com:22
www.cuongsex.com:8080
www.cuongsex.com:8880
www.cuongsex.com:2052
www.cuongsex.com:2082
www.cuongsex.com:2086
www.cuongsex.com:2095
www.cuongsex.com:443
www.cuongsex.com:2053
www.cuongsex.com:2083
www.cuongsex.com:2087
www.cuongsex.com:2096
www.cuongsex.com:8443
downadup.cuongsex.com:80
downadup.cuongsex.com:22
downadup.cuongsex.com:8080
downadup.cuongsex.com:8880
downadup.cuongsex.com:2052
downadup.cuongsex.com:2082
downadup.cuongsex.com:2086
downadup.cuongsex.com:2095
downadup.cuongsex.com:443
downadup.cuongsex.com:2053
downadup.cuongsex.com:2083
downadup.cuongsex.com:2087
downadup.cuongsex.com:2096
downadup.cuongsex.com:8443
stuxnet.cuongsex.com:80
stuxnet.cuongsex.com:22
stuxnet.cuongsex.com:8080
stuxnet.cuongsex.com:8880
stuxnet.cuongsex.com:2052
stuxnet.cuongsex.com:2082
stuxnet.cuongsex.com:2086
stuxnet.cuongsex.com:2095
stuxnet.cuongsex.com:443
stuxnet.cuongsex.com:2053
stuxnet.cuongsex.com:2083
stuxnet.cuongsex.com:2087
stuxnet.cuongsex.com:2096
stuxnet.cuongsex.com:8443
zbot.cuongsex.com:80
zbot.cuongsex.com:22
zbot.cuongsex.com:8080
zbot.cuongsex.com:8880
zbot.cuongsex.com:2052
zbot.cuongsex.com:2082
zbot.cuongsex.com:2086
zbot.cuongsex.com:2095
zbot.cuongsex.com:443
zbot.cuongsex.com:2053
zbot.cuongsex.com:2083
zbot.cuongsex.com:2087
zbot.cuongsex.com:2096
zbot.cuongsex.com:8443
remcos.cuongsex.com:80
remcos.cuongsex.com:22
remcos.cuongsex.com:8080
remcos.cuongsex.com:8880
remcos.cuongsex.com:2052
remcos.cuongsex.com:2082
remcos.cuongsex.com:2086
remcos.cuongsex.com:2095
remcos.cuongsex.com:443
remcos.cuongsex.com:2053
remcos.cuongsex.com:2083
remcos.cuongsex.com:2087
remcos.cuongsex.com:2096
remcos.cuongsex.com:8443

Mutex

ilZPgziJP6RR

Attributes

delay
0
install
true
install_file
xsi7.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  f160577708f3e0116949aafd696972ca8c9d14afa502ce8daaa1676305285a2c
- Size 45KB
- SHA256 f160577708f3e0116949aafd696972ca8c9d14afa502ce8daaa1676305285a2c
- MD5 6a6b1501eb7bf78047c97c64353c6141
- SHA1 2952968f77293ed6f60f724eca6c0fe0dd5cf4ae
- SHA512 776beb4929be6770805c3e864a816de13f7794697f634dfce34f30dd4361508c49657c0e93539b9ad05ff7501875b4cfa2a1776f8847cec90f7aa67110e43d97
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0yFjrdjYkk8PIucjbrgX3iVga5L1/8YC3tWBE:MuBGJTPho2/LBXQBusbUXSVv5LCYyGdG
- TLSH
  T1C2231B0037E9812BF2BE4F7499F26245867AF6733603D54A1CC441DB5B13BC69A43AEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2