asyncrat | 64d8b577891901b5c46887be5e25a63ae2395329d0c63c53f236ac17023e9875

Sharing

Copy URL Twitter E-mail

General

Target
64d8b577891901b5c46887be5e25a63ae2395329d0c63c53f236ac17023e9875
Size 45KB
Sample260707-rr18rsft6v
SHA256 64d8b577891901b5c46887be5e25a63ae2395329d0c63c53f236ac17023e9875
MD5 0d05432014edf4557e26e62f08b902d2
SHA1 511f40e386c6b3f578ae74336734b18b7f6f0b65
SHA512 c9af864dd31cf4d5088b0abd1cc09749841a392412e6823ca08421e689f90ccd131adcd51e0e06ef86a04295d1cea4996830b71c3b3e534ba5bfdd6596f9999a
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFnm/9GgROPI2zjbsgX3izgkitZxoORm521BDZEx:MuLAZTnbg2Em1h323bjXSsDxocdEx
TLSH
T180232B003BE9812BF2BE4BB89CF26245467AF1B36603D54D1CC4529B5713FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vlxxzz.net:80
vlxxzz.net:22
vlxxzz.net:8080
vlxxzz.net:8880
vlxxzz.net:2052
vlxxzz.net:2082
vlxxzz.net:2086
vlxxzz.net:2095
vlxxzz.net:443
vlxxzz.net:2053
vlxxzz.net:2083
vlxxzz.net:2087
vlxxzz.net:2096
vlxxzz.net:8443
www.vlxxzz.net:80
www.vlxxzz.net:22
www.vlxxzz.net:8080
www.vlxxzz.net:8880
www.vlxxzz.net:2052
www.vlxxzz.net:2082
www.vlxxzz.net:2086
www.vlxxzz.net:2095
www.vlxxzz.net:443
www.vlxxzz.net:2053
www.vlxxzz.net:2083
www.vlxxzz.net:2087
www.vlxxzz.net:2096
www.vlxxzz.net:8443
shamoon.vlxxzz.net:80
shamoon.vlxxzz.net:22
shamoon.vlxxzz.net:8080
shamoon.vlxxzz.net:8880
shamoon.vlxxzz.net:2052
shamoon.vlxxzz.net:2082
shamoon.vlxxzz.net:2086
shamoon.vlxxzz.net:2095
shamoon.vlxxzz.net:443
shamoon.vlxxzz.net:2053
shamoon.vlxxzz.net:2083
shamoon.vlxxzz.net:2087
shamoon.vlxxzz.net:2096
shamoon.vlxxzz.net:8443
trisis.vlxxzz.net:80
trisis.vlxxzz.net:22
trisis.vlxxzz.net:8080
trisis.vlxxzz.net:8880
trisis.vlxxzz.net:2052
trisis.vlxxzz.net:2082
trisis.vlxxzz.net:2086
trisis.vlxxzz.net:2095
trisis.vlxxzz.net:443
trisis.vlxxzz.net:2053
trisis.vlxxzz.net:2083
trisis.vlxxzz.net:2087
trisis.vlxxzz.net:2096
trisis.vlxxzz.net:8443
darkside.vlxxzz.net:80
darkside.vlxxzz.net:22
darkside.vlxxzz.net:8080
darkside.vlxxzz.net:8880
darkside.vlxxzz.net:2052
darkside.vlxxzz.net:2082
darkside.vlxxzz.net:2086
darkside.vlxxzz.net:2095
darkside.vlxxzz.net:443
darkside.vlxxzz.net:2053
darkside.vlxxzz.net:2083
darkside.vlxxzz.net:2087
darkside.vlxxzz.net:2096
darkside.vlxxzz.net:8443
remcos.vlxxzz.net:80
remcos.vlxxzz.net:22
remcos.vlxxzz.net:8080
remcos.vlxxzz.net:8880
remcos.vlxxzz.net:2052
remcos.vlxxzz.net:2082
remcos.vlxxzz.net:2086
remcos.vlxxzz.net:2095
remcos.vlxxzz.net:443
remcos.vlxxzz.net:2053
remcos.vlxxzz.net:2083
remcos.vlxxzz.net:2087
remcos.vlxxzz.net:2096
remcos.vlxxzz.net:8443

Mutex

s810B3bbxhiO

Attributes

delay
0
install
true
install_file
xsajg.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  64d8b577891901b5c46887be5e25a63ae2395329d0c63c53f236ac17023e9875
- Size 45KB
- SHA256 64d8b577891901b5c46887be5e25a63ae2395329d0c63c53f236ac17023e9875
- MD5 0d05432014edf4557e26e62f08b902d2
- SHA1 511f40e386c6b3f578ae74336734b18b7f6f0b65
- SHA512 c9af864dd31cf4d5088b0abd1cc09749841a392412e6823ca08421e689f90ccd131adcd51e0e06ef86a04295d1cea4996830b71c3b3e534ba5bfdd6596f9999a
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFnm/9GgROPI2zjbsgX3izgkitZxoORm521BDZEx:MuLAZTnbg2Em1h323bjXSsDxocdEx
- TLSH
  T180232B003BE9812BF2BE4BB89CF26245467AF1B36603D54D1CC4529B5713FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2