asyncrat | 1deee9ab0cf1adc1fc186ce83142f588ec6895bf16adcd0cbabace62349951f2

Sharing

Copy URL Twitter E-mail

General

Target
1deee9ab0cf1adc1fc186ce83142f588ec6895bf16adcd0cbabace62349951f2
Size 45KB
Sample260704-ye5tracz4v
SHA256 1deee9ab0cf1adc1fc186ce83142f588ec6895bf16adcd0cbabace62349951f2
MD5 86cc6731f9adf700fae91d85271abab6
SHA1 ab861ebd56a6c74a5946b709933b784797cb9fb2
SHA512 0342ada3b0f29361463945fd12b0956283205e130bbf944e4b649ba353fc16f863dc66e517b93627955eb89a88c81b6504adc47ccd33e63e8cefdf103151a9ff
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IxJaxjwHuPI+zjbIgP3izXb0tcF69AK0Zr6nBDg:cu6YepTPso2Be+3+3bfPSzXbUe6cr6B0
TLSH
T1AC231A0037E8822BF2BE4FB898F26145867AF5633603D54D2CC452DB5723FC696526EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexgaga.com:80
sexgaga.com:22
sexgaga.com:8080
sexgaga.com:8880
sexgaga.com:2052
sexgaga.com:2082
sexgaga.com:2086
sexgaga.com:2095
sexgaga.com:443
sexgaga.com:2053
sexgaga.com:2083
sexgaga.com:2087
sexgaga.com:2096
sexgaga.com:8443
www.sexgaga.com:80
www.sexgaga.com:22
www.sexgaga.com:8080
www.sexgaga.com:8880
www.sexgaga.com:2052
www.sexgaga.com:2082
www.sexgaga.com:2086
www.sexgaga.com:2095
www.sexgaga.com:443
www.sexgaga.com:2053
www.sexgaga.com:2083
www.sexgaga.com:2087
www.sexgaga.com:2096
www.sexgaga.com:8443
agenttesla.sexgaga.com:80
agenttesla.sexgaga.com:22
agenttesla.sexgaga.com:8080
agenttesla.sexgaga.com:8880
agenttesla.sexgaga.com:2052
agenttesla.sexgaga.com:2082
agenttesla.sexgaga.com:2086
agenttesla.sexgaga.com:2095
agenttesla.sexgaga.com:443
agenttesla.sexgaga.com:2053
agenttesla.sexgaga.com:2083
agenttesla.sexgaga.com:2087
agenttesla.sexgaga.com:2096
agenttesla.sexgaga.com:8443
industroyer.sexgaga.com:80
industroyer.sexgaga.com:22
industroyer.sexgaga.com:8080
industroyer.sexgaga.com:8880
industroyer.sexgaga.com:2052
industroyer.sexgaga.com:2082
industroyer.sexgaga.com:2086
industroyer.sexgaga.com:2095
industroyer.sexgaga.com:443
industroyer.sexgaga.com:2053
industroyer.sexgaga.com:2083
industroyer.sexgaga.com:2087
industroyer.sexgaga.com:2096
industroyer.sexgaga.com:8443
zeus.sexgaga.com:80
zeus.sexgaga.com:22
zeus.sexgaga.com:8080
zeus.sexgaga.com:8880
zeus.sexgaga.com:2052
zeus.sexgaga.com:2082
zeus.sexgaga.com:2086
zeus.sexgaga.com:2095
zeus.sexgaga.com:443
zeus.sexgaga.com:2053
zeus.sexgaga.com:2083
zeus.sexgaga.com:2087
zeus.sexgaga.com:2096
zeus.sexgaga.com:8443
zbot.sexgaga.com:80
zbot.sexgaga.com:22
zbot.sexgaga.com:8080
zbot.sexgaga.com:8880
zbot.sexgaga.com:2052
zbot.sexgaga.com:2082
zbot.sexgaga.com:2086
zbot.sexgaga.com:2095
zbot.sexgaga.com:443
zbot.sexgaga.com:2053
zbot.sexgaga.com:2083
zbot.sexgaga.com:2087
zbot.sexgaga.com:2096
zbot.sexgaga.com:8443

Mutex

lQ3AyOlArjBS

Attributes

delay
0
install
true
install_file
q4j4h8aj.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1deee9ab0cf1adc1fc186ce83142f588ec6895bf16adcd0cbabace62349951f2
- Size 45KB
- SHA256 1deee9ab0cf1adc1fc186ce83142f588ec6895bf16adcd0cbabace62349951f2
- MD5 86cc6731f9adf700fae91d85271abab6
- SHA1 ab861ebd56a6c74a5946b709933b784797cb9fb2
- SHA512 0342ada3b0f29361463945fd12b0956283205e130bbf944e4b649ba353fc16f863dc66e517b93627955eb89a88c81b6504adc47ccd33e63e8cefdf103151a9ff
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IxJaxjwHuPI+zjbIgP3izXb0tcF69AK0Zr6nBDg:cu6YepTPso2Be+3+3bfPSzXbUe6cr6B0
- TLSH
  T1AC231A0037E8822BF2BE4FB898F26145867AF5633603D54D2CC452DB5723FC696526EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2