asyncrat | fa556803bda68b12b1d62c17fa27f2273ded6277075c93925c665f539cc1f477

Sharing

Copy URL Twitter E-mail

General

Target
fa556803bda68b12b1d62c17fa27f2273ded6277075c93925c665f539cc1f477
Size 45KB
Sample260705-yv2r2abs7k
SHA256 fa556803bda68b12b1d62c17fa27f2273ded6277075c93925c665f539cc1f477
MD5 38c9b9557db1cf7cfcb65118db87db14
SHA1 1c5b03893aadc7c93d7a538037ff1ce2508c2a60
SHA512 d74b9deb1248ca7f16a0cc997a443d5f971bb492c0e64f640cac42df7468fd46ed4058eec59ba33b03d1dda76cdb7cf5b343d39bf87e46bdf1218ad36b4446be
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1W/qpG3jHuPIszjbJgXyiBttpdKMofYNnBDZUx:cu6YepTPso2zIM3s3bGX7f4kXdUx
TLSH
T188231A003BE8813BF2BE5FB898F26145467AF6676603D64D1CC441DB4623BC69A436FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexkurt.com:80
sexkurt.com:22
sexkurt.com:8080
sexkurt.com:8880
sexkurt.com:2052
sexkurt.com:2082
sexkurt.com:2086
sexkurt.com:2095
sexkurt.com:443
sexkurt.com:2053
sexkurt.com:2083
sexkurt.com:2087
sexkurt.com:2096
sexkurt.com:8443
www.sexkurt.com:80
www.sexkurt.com:22
www.sexkurt.com:8080
www.sexkurt.com:8880
www.sexkurt.com:2052
www.sexkurt.com:2082
www.sexkurt.com:2086
www.sexkurt.com:2095
www.sexkurt.com:443
www.sexkurt.com:2053
www.sexkurt.com:2083
www.sexkurt.com:2087
www.sexkurt.com:2096
www.sexkurt.com:8443
hacker.sexkurt.com:80
hacker.sexkurt.com:22
hacker.sexkurt.com:8080
hacker.sexkurt.com:8880
hacker.sexkurt.com:2052
hacker.sexkurt.com:2082
hacker.sexkurt.com:2086
hacker.sexkurt.com:2095
hacker.sexkurt.com:443
hacker.sexkurt.com:2053
hacker.sexkurt.com:2083
hacker.sexkurt.com:2087
hacker.sexkurt.com:2096
hacker.sexkurt.com:8443
remcos.sexkurt.com:80
remcos.sexkurt.com:22
remcos.sexkurt.com:8080
remcos.sexkurt.com:8880
remcos.sexkurt.com:2052
remcos.sexkurt.com:2082
remcos.sexkurt.com:2086
remcos.sexkurt.com:2095
remcos.sexkurt.com:443
remcos.sexkurt.com:2053
remcos.sexkurt.com:2083
remcos.sexkurt.com:2087
remcos.sexkurt.com:2096
remcos.sexkurt.com:8443
sodinokibi.sexkurt.com:80
sodinokibi.sexkurt.com:22
sodinokibi.sexkurt.com:8080
sodinokibi.sexkurt.com:8880
sodinokibi.sexkurt.com:2052
sodinokibi.sexkurt.com:2082
sodinokibi.sexkurt.com:2086
sodinokibi.sexkurt.com:2095
sodinokibi.sexkurt.com:443
sodinokibi.sexkurt.com:2053
sodinokibi.sexkurt.com:2083
sodinokibi.sexkurt.com:2087
sodinokibi.sexkurt.com:2096
sodinokibi.sexkurt.com:8443
nimda.sexkurt.com:80
nimda.sexkurt.com:22
nimda.sexkurt.com:8080
nimda.sexkurt.com:8880
nimda.sexkurt.com:2052
nimda.sexkurt.com:2082
nimda.sexkurt.com:2086
nimda.sexkurt.com:2095
nimda.sexkurt.com:443
nimda.sexkurt.com:2053
nimda.sexkurt.com:2083
nimda.sexkurt.com:2087
nimda.sexkurt.com:2096
nimda.sexkurt.com:8443

Mutex

nA4cKoo875EI

Attributes

delay
0
install
true
install_file
6s9qk6xq.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  fa556803bda68b12b1d62c17fa27f2273ded6277075c93925c665f539cc1f477
- Size 45KB
- SHA256 fa556803bda68b12b1d62c17fa27f2273ded6277075c93925c665f539cc1f477
- MD5 38c9b9557db1cf7cfcb65118db87db14
- SHA1 1c5b03893aadc7c93d7a538037ff1ce2508c2a60
- SHA512 d74b9deb1248ca7f16a0cc997a443d5f971bb492c0e64f640cac42df7468fd46ed4058eec59ba33b03d1dda76cdb7cf5b343d39bf87e46bdf1218ad36b4446be
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1W/qpG3jHuPIszjbJgXyiBttpdKMofYNnBDZUx:cu6YepTPso2zIM3s3bGX7f4kXdUx
- TLSH
  T188231A003BE8813BF2BE5FB898F26145467AF6676603D64D1CC441DB4623BC69A436FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2