asyncrat | 6b980ebf114e2923b94cd72a1ae7ba448faff18a11a4c50f7f379648354c3cee

Sharing

Copy URL Twitter E-mail

General

Target
6b980ebf114e2923b94cd72a1ae7ba448faff18a11a4c50f7f379648354c3cee.exe
Size 45KB
Sample260707-l6fbysfv2t
SHA256 6b980ebf114e2923b94cd72a1ae7ba448faff18a11a4c50f7f379648354c3cee
MD5 290ff8690e5f3bde89c3a3a470bb068c
SHA1 e3b25794c0f841f52fefb427f195f87ed6ec1494
SHA512 da3d2788e22193ab73853104a508cbab9c61f28ba9a7e763b0f6d8ec4c0c9d4cc62959a3c246896ef2b4668191532e3e1ab7737d0f0568f81362d94d106931f8
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPIQojbfgX3ieexrZ6sPTYzPZAX4zBDZsx:EulCJTHl42sU3QAboXSLxrQsPIPKUdsx
TLSH
T18B231B0037E8C12BF2BE4F7899F26145867AF6672603D58D1CC411DB5623BC6DA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexviet74.com:80
sexviet74.com:22
sexviet74.com:8080
sexviet74.com:8880
sexviet74.com:2052
sexviet74.com:2082
sexviet74.com:2086
sexviet74.com:2095
sexviet74.com:443
sexviet74.com:2053
sexviet74.com:2083
sexviet74.com:2087
sexviet74.com:2096
sexviet74.com:8443
www.sexviet74.com:80
www.sexviet74.com:22
www.sexviet74.com:8080
www.sexviet74.com:8880
www.sexviet74.com:2052
www.sexviet74.com:2082
www.sexviet74.com:2086
www.sexviet74.com:2095
www.sexviet74.com:443
www.sexviet74.com:2053
www.sexviet74.com:2083
www.sexviet74.com:2087
www.sexviet74.com:2096
www.sexviet74.com:8443
connect.sexviet74.com:80
connect.sexviet74.com:22
connect.sexviet74.com:8080
connect.sexviet74.com:8880
connect.sexviet74.com:2052
connect.sexviet74.com:2082
connect.sexviet74.com:2086
connect.sexviet74.com:2095
connect.sexviet74.com:443
connect.sexviet74.com:2053
connect.sexviet74.com:2083
connect.sexviet74.com:2087
connect.sexviet74.com:2096
connect.sexviet74.com:8443
malware.sexviet74.com:80
malware.sexviet74.com:22
malware.sexviet74.com:8080
malware.sexviet74.com:8880
malware.sexviet74.com:2052
malware.sexviet74.com:2082
malware.sexviet74.com:2086
malware.sexviet74.com:2095
malware.sexviet74.com:443
malware.sexviet74.com:2053
malware.sexviet74.com:2083
malware.sexviet74.com:2087
malware.sexviet74.com:2096
malware.sexviet74.com:8443
shamoon.sexviet74.com:80
shamoon.sexviet74.com:22
shamoon.sexviet74.com:8080
shamoon.sexviet74.com:8880
shamoon.sexviet74.com:2052
shamoon.sexviet74.com:2082
shamoon.sexviet74.com:2086
shamoon.sexviet74.com:2095
shamoon.sexviet74.com:443
shamoon.sexviet74.com:2053
shamoon.sexviet74.com:2083
shamoon.sexviet74.com:2087
shamoon.sexviet74.com:2096
shamoon.sexviet74.com:8443

Mutex

NHEXuYeBr3t3

Attributes

delay
0
install
true
install_file
ssnr9b.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6b980ebf114e2923b94cd72a1ae7ba448faff18a11a4c50f7f379648354c3cee.exe
- Size 45KB
- SHA256 6b980ebf114e2923b94cd72a1ae7ba448faff18a11a4c50f7f379648354c3cee
- MD5 290ff8690e5f3bde89c3a3a470bb068c
- SHA1 e3b25794c0f841f52fefb427f195f87ed6ec1494
- SHA512 da3d2788e22193ab73853104a508cbab9c61f28ba9a7e763b0f6d8ec4c0c9d4cc62959a3c246896ef2b4668191532e3e1ab7737d0f0568f81362d94d106931f8
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPIQojbfgX3ieexrZ6sPTYzPZAX4zBDZsx:EulCJTHl42sU3QAboXSLxrQsPIPKUdsx
- TLSH
  T18B231B0037E8C12BF2BE4F7899F26145867AF6672603D58D1CC411DB5623BC6DA426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2