asyncrat | dbe2a5d4affb7d34470602f95f36b2c309d00c471cde2f0211b62868d743ab36

Sharing

Copy URL Twitter E-mail

General

Target
dbe2a5d4affb7d34470602f95f36b2c309d00c471cde2f0211b62868d743ab36
Size 45KB
Sample260707-rl9yqagx6j
SHA256 dbe2a5d4affb7d34470602f95f36b2c309d00c471cde2f0211b62868d743ab36
MD5 fc7dc1c7ed4d655c3f46545faad80132
SHA1 9001fe4fcf34745f9d17d4d539422debe3f56a30
SHA512 c58a5b8bc3092fbff0a9ecc57fac95945ce50c7829e0014e2278d99af8de4373e765aaf95e8349c441888c531370102f2d9edcc2966e1cc42aa51397189c43d5
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVD0ewUkA1MiZPI7zjbXgW3ipevxjLuDjIUBDZEx:MuBGJTPho2iwvDiW73bwWSwpjLEfdEx
TLSH
T15E230A0037E8812BF2BE4F78A9F26245867AF6736603D5491CC451DB5723BC68A436FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vlxxzz.net:80
vlxxzz.net:22
vlxxzz.net:8080
vlxxzz.net:8880
vlxxzz.net:2052
vlxxzz.net:2082
vlxxzz.net:2086
vlxxzz.net:2095
vlxxzz.net:443
vlxxzz.net:2053
vlxxzz.net:2083
vlxxzz.net:2087
vlxxzz.net:2096
vlxxzz.net:8443
www.vlxxzz.net:80
www.vlxxzz.net:22
www.vlxxzz.net:8080
www.vlxxzz.net:8880
www.vlxxzz.net:2052
www.vlxxzz.net:2082
www.vlxxzz.net:2086
www.vlxxzz.net:2095
www.vlxxzz.net:443
www.vlxxzz.net:2053
www.vlxxzz.net:2083
www.vlxxzz.net:2087
www.vlxxzz.net:2096
www.vlxxzz.net:8443
remote.vlxxzz.net:80
remote.vlxxzz.net:22
remote.vlxxzz.net:8080
remote.vlxxzz.net:8880
remote.vlxxzz.net:2052
remote.vlxxzz.net:2082
remote.vlxxzz.net:2086
remote.vlxxzz.net:2095
remote.vlxxzz.net:443
remote.vlxxzz.net:2053
remote.vlxxzz.net:2083
remote.vlxxzz.net:2087
remote.vlxxzz.net:2096
remote.vlxxzz.net:8443
trickbot.vlxxzz.net:80
trickbot.vlxxzz.net:22
trickbot.vlxxzz.net:8080
trickbot.vlxxzz.net:8880
trickbot.vlxxzz.net:2052
trickbot.vlxxzz.net:2082
trickbot.vlxxzz.net:2086
trickbot.vlxxzz.net:2095
trickbot.vlxxzz.net:443
trickbot.vlxxzz.net:2053
trickbot.vlxxzz.net:2083
trickbot.vlxxzz.net:2087
trickbot.vlxxzz.net:2096
trickbot.vlxxzz.net:8443
shamoon.vlxxzz.net:80
shamoon.vlxxzz.net:22
shamoon.vlxxzz.net:8080
shamoon.vlxxzz.net:8880
shamoon.vlxxzz.net:2052
shamoon.vlxxzz.net:2082
shamoon.vlxxzz.net:2086
shamoon.vlxxzz.net:2095
shamoon.vlxxzz.net:443
shamoon.vlxxzz.net:2053
shamoon.vlxxzz.net:2083
shamoon.vlxxzz.net:2087
shamoon.vlxxzz.net:2096
shamoon.vlxxzz.net:8443
mirai.vlxxzz.net:80
mirai.vlxxzz.net:22
mirai.vlxxzz.net:8080
mirai.vlxxzz.net:8880
mirai.vlxxzz.net:2052
mirai.vlxxzz.net:2082
mirai.vlxxzz.net:2086
mirai.vlxxzz.net:2095
mirai.vlxxzz.net:443
mirai.vlxxzz.net:2053
mirai.vlxxzz.net:2083
mirai.vlxxzz.net:2087
mirai.vlxxzz.net:2096
mirai.vlxxzz.net:8443

Mutex

KUtj4K2twvbN

Attributes

delay
0
install
true
install_file
b8sh.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  dbe2a5d4affb7d34470602f95f36b2c309d00c471cde2f0211b62868d743ab36
- Size 45KB
- SHA256 dbe2a5d4affb7d34470602f95f36b2c309d00c471cde2f0211b62868d743ab36
- MD5 fc7dc1c7ed4d655c3f46545faad80132
- SHA1 9001fe4fcf34745f9d17d4d539422debe3f56a30
- SHA512 c58a5b8bc3092fbff0a9ecc57fac95945ce50c7829e0014e2278d99af8de4373e765aaf95e8349c441888c531370102f2d9edcc2966e1cc42aa51397189c43d5
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVD0ewUkA1MiZPI7zjbXgW3ipevxjLuDjIUBDZEx:MuBGJTPho2iwvDiW73bwWSwpjLEfdEx
- TLSH
  T15E230A0037E8812BF2BE4F78A9F26245867AF6736603D5491CC451DB5723BC68A436FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2