asyncrat | f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf

Sharing

Copy URL Twitter E-mail

General

Target
f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf
Size 45KB
Sample260706-gdtawsd16n
SHA256 f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf
MD5 69c72b36a3b5a811fe9655141cff9f4e
SHA1 84850b4100da6a3e1c61d7ab4759d7d8524b3620
SHA512 079bdf03ae22d7383db7adeb918b9dff18c08bc7a5582ae9245ef1c5a92bf1f5c8a78e9142f87175baa70b588cfae1daf69cc237d1b2b15536b19bd090d337de
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIszjbGgX3iO1hpuR7F5H2ClW6BDZsx:EulCJTHl42MRvs3bZXSO1hpiDHHDdsx
TLSH
T138231A003BE8C12BF2BE5B78A8F26145867AF6677603D59D1CC4419B5713FC28A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexgaga.com:80
sexgaga.com:22
sexgaga.com:8080
sexgaga.com:8880
sexgaga.com:2052
sexgaga.com:2082
sexgaga.com:2086
sexgaga.com:2095
sexgaga.com:443
sexgaga.com:2053
sexgaga.com:2083
sexgaga.com:2087
sexgaga.com:2096
sexgaga.com:8443
www.sexgaga.com:80
www.sexgaga.com:22
www.sexgaga.com:8080
www.sexgaga.com:8880
www.sexgaga.com:2052
www.sexgaga.com:2082
www.sexgaga.com:2086
www.sexgaga.com:2095
www.sexgaga.com:443
www.sexgaga.com:2053
www.sexgaga.com:2083
www.sexgaga.com:2087
www.sexgaga.com:2096
www.sexgaga.com:8443
hermeticwiper.sexgaga.com:80
hermeticwiper.sexgaga.com:22
hermeticwiper.sexgaga.com:8080
hermeticwiper.sexgaga.com:8880
hermeticwiper.sexgaga.com:2052
hermeticwiper.sexgaga.com:2082
hermeticwiper.sexgaga.com:2086
hermeticwiper.sexgaga.com:2095
hermeticwiper.sexgaga.com:443
hermeticwiper.sexgaga.com:2053
hermeticwiper.sexgaga.com:2083
hermeticwiper.sexgaga.com:2087
hermeticwiper.sexgaga.com:2096
hermeticwiper.sexgaga.com:8443
notpetya.sexgaga.com:80
notpetya.sexgaga.com:22
notpetya.sexgaga.com:8080
notpetya.sexgaga.com:8880
notpetya.sexgaga.com:2052
notpetya.sexgaga.com:2082
notpetya.sexgaga.com:2086
notpetya.sexgaga.com:2095
notpetya.sexgaga.com:443
notpetya.sexgaga.com:2053
notpetya.sexgaga.com:2083
notpetya.sexgaga.com:2087
notpetya.sexgaga.com:2096
notpetya.sexgaga.com:8443
ursnif.sexgaga.com:80
ursnif.sexgaga.com:22
ursnif.sexgaga.com:8080
ursnif.sexgaga.com:8880
ursnif.sexgaga.com:2052
ursnif.sexgaga.com:2082
ursnif.sexgaga.com:2086
ursnif.sexgaga.com:2095
ursnif.sexgaga.com:443
ursnif.sexgaga.com:2053
ursnif.sexgaga.com:2083
ursnif.sexgaga.com:2087
ursnif.sexgaga.com:2096
ursnif.sexgaga.com:8443
klez.sexgaga.com:80
klez.sexgaga.com:22
klez.sexgaga.com:8080
klez.sexgaga.com:8880
klez.sexgaga.com:2052
klez.sexgaga.com:2082
klez.sexgaga.com:2086
klez.sexgaga.com:2095
klez.sexgaga.com:443
klez.sexgaga.com:2053
klez.sexgaga.com:2083
klez.sexgaga.com:2087
klez.sexgaga.com:2096
klez.sexgaga.com:8443

Mutex

KHFpySrgvyYF

Attributes

delay
0
install
true
install_file
5006m4.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf
- Size 45KB
- SHA256 f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf
- MD5 69c72b36a3b5a811fe9655141cff9f4e
- SHA1 84850b4100da6a3e1c61d7ab4759d7d8524b3620
- SHA512 079bdf03ae22d7383db7adeb918b9dff18c08bc7a5582ae9245ef1c5a92bf1f5c8a78e9142f87175baa70b588cfae1daf69cc237d1b2b15536b19bd090d337de
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIszjbGgX3iO1hpuR7F5H2ClW6BDZsx:EulCJTHl42MRvs3bZXSO1hpiDHHDdsx
- TLSH
  T138231A003BE8C12BF2BE5B78A8F26145867AF6677603D59D1CC4419B5713FC28A426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2