asyncrat | 3773c8b64eaa503f40d0040c20f0e7675e8158dd03c29c2710efc3e9304c0a28

Sharing

Copy URL Twitter E-mail

General

Target
3773c8b64eaa503f40d0040c20f0e7675e8158dd03c29c2710efc3e9304c0a28
Size 45KB
Sample260706-epldbahw3z
SHA256 3773c8b64eaa503f40d0040c20f0e7675e8158dd03c29c2710efc3e9304c0a28
MD5 0001c46cac82fc2232e64db797e42bf8
SHA1 3428dda7b64d9c5b70eb8fdb8d85c4e13769f8dc
SHA512 872f134697fbe79bd9346694199add521f570beef4f5792befcc09a3387752aa5007067b5f643a3d2116ffa58db916bfa6c88e077a44f7d91c3e8fead076bb19
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFM3HE4SVoOPIGQzjbwgj3i+lBTP7jVmmat6BDZEx:MuLAZTnbg2NUZo3GQ3b3jSQB7pdEx
TLSH
T145232A003BE8812BF2BF4F78ADF26145867AF2637603D5491CC451DB5623FC69A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexkurt.com:80
sexkurt.com:22
sexkurt.com:8080
sexkurt.com:8880
sexkurt.com:2052
sexkurt.com:2082
sexkurt.com:2086
sexkurt.com:2095
sexkurt.com:443
sexkurt.com:2053
sexkurt.com:2083
sexkurt.com:2087
sexkurt.com:2096
sexkurt.com:8443
www.sexkurt.com:80
www.sexkurt.com:22
www.sexkurt.com:8080
www.sexkurt.com:8880
www.sexkurt.com:2052
www.sexkurt.com:2082
www.sexkurt.com:2086
www.sexkurt.com:2095
www.sexkurt.com:443
www.sexkurt.com:2053
www.sexkurt.com:2083
www.sexkurt.com:2087
www.sexkurt.com:2096
www.sexkurt.com:8443
ursnif.sexkurt.com:80
ursnif.sexkurt.com:22
ursnif.sexkurt.com:8080
ursnif.sexkurt.com:8880
ursnif.sexkurt.com:2052
ursnif.sexkurt.com:2082
ursnif.sexkurt.com:2086
ursnif.sexkurt.com:2095
ursnif.sexkurt.com:443
ursnif.sexkurt.com:2053
ursnif.sexkurt.com:2083
ursnif.sexkurt.com:2087
ursnif.sexkurt.com:2096
ursnif.sexkurt.com:8443
sasser.sexkurt.com:80
sasser.sexkurt.com:22
sasser.sexkurt.com:8080
sasser.sexkurt.com:8880
sasser.sexkurt.com:2052
sasser.sexkurt.com:2082
sasser.sexkurt.com:2086
sasser.sexkurt.com:2095
sasser.sexkurt.com:443
sasser.sexkurt.com:2053
sasser.sexkurt.com:2083
sasser.sexkurt.com:2087
sasser.sexkurt.com:2096
sasser.sexkurt.com:8443
clop.sexkurt.com:80
clop.sexkurt.com:22
clop.sexkurt.com:8080
clop.sexkurt.com:8880
clop.sexkurt.com:2052
clop.sexkurt.com:2082
clop.sexkurt.com:2086
clop.sexkurt.com:2095
clop.sexkurt.com:443
clop.sexkurt.com:2053
clop.sexkurt.com:2083
clop.sexkurt.com:2087
clop.sexkurt.com:2096
clop.sexkurt.com:8443
blacklotus.sexkurt.com:80
blacklotus.sexkurt.com:22
blacklotus.sexkurt.com:8080
blacklotus.sexkurt.com:8880
blacklotus.sexkurt.com:2052
blacklotus.sexkurt.com:2082
blacklotus.sexkurt.com:2086
blacklotus.sexkurt.com:2095
blacklotus.sexkurt.com:443
blacklotus.sexkurt.com:2053
blacklotus.sexkurt.com:2083
blacklotus.sexkurt.com:2087
blacklotus.sexkurt.com:2096
blacklotus.sexkurt.com:8443

Mutex

FjJkjJTzE0HJ

Attributes

delay
0
install
true
install_file
438dm.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  3773c8b64eaa503f40d0040c20f0e7675e8158dd03c29c2710efc3e9304c0a28
- Size 45KB
- SHA256 3773c8b64eaa503f40d0040c20f0e7675e8158dd03c29c2710efc3e9304c0a28
- MD5 0001c46cac82fc2232e64db797e42bf8
- SHA1 3428dda7b64d9c5b70eb8fdb8d85c4e13769f8dc
- SHA512 872f134697fbe79bd9346694199add521f570beef4f5792befcc09a3387752aa5007067b5f643a3d2116ffa58db916bfa6c88e077a44f7d91c3e8fead076bb19
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFM3HE4SVoOPIGQzjbwgj3i+lBTP7jVmmat6BDZEx:MuLAZTnbg2NUZo3GQ3b3jSQB7pdEx
- TLSH
  T145232A003BE8812BF2BF4F78ADF26145867AF2637603D5491CC451DB5623FC69A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2