asyncrat | acc9ee46646963467720af55875af9b180b95f28df79351b7adeb58190642c08

Sharing

Copy URL Twitter E-mail

General

Target
acc9ee46646963467720af55875af9b180b95f28df79351b7adeb58190642c08
Size 45KB
Sample260707-stsvvagz4p
SHA256 acc9ee46646963467720af55875af9b180b95f28df79351b7adeb58190642c08
MD5 98dc8bebb245a97395c8107155e3f47f
SHA1 ffc50a34fb6bd90bfd52bfc5db2139c2c6f9ba5e
SHA512 512d043637486bca8103d3825329bf4a3faff18d005187a690bbbbe3d1f1d431886de50a67b0cf4bd7a0ff442419b2f0a19c424d0574eacd43382b448b155d0f
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Jw0Q+KXPIlzjb4gX3iYHOWcNhgM6ejDFKpUBDZW:cu6YepTPso229l3bvXSYHOWcdhBHdUx
TLSH
T1A2232A003BE8C127F2BE4FB899F26145867AF5632603DA4D2CC451DB5623FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

viet69sex.blog:80
viet69sex.blog:22
viet69sex.blog:8080
viet69sex.blog:8880
viet69sex.blog:2052
viet69sex.blog:2082
viet69sex.blog:2086
viet69sex.blog:2095
viet69sex.blog:443
viet69sex.blog:2053
viet69sex.blog:2083
viet69sex.blog:2087
viet69sex.blog:2096
viet69sex.blog:8443
www.viet69sex.blog:80
www.viet69sex.blog:22
www.viet69sex.blog:8080
www.viet69sex.blog:8880
www.viet69sex.blog:2052
www.viet69sex.blog:2082
www.viet69sex.blog:2086
www.viet69sex.blog:2095
www.viet69sex.blog:443
www.viet69sex.blog:2053
www.viet69sex.blog:2083
www.viet69sex.blog:2087
www.viet69sex.blog:2096
www.viet69sex.blog:8443
hermeticwiper.viet69sex.blog:80
hermeticwiper.viet69sex.blog:22
hermeticwiper.viet69sex.blog:8080
hermeticwiper.viet69sex.blog:8880
hermeticwiper.viet69sex.blog:2052
hermeticwiper.viet69sex.blog:2082
hermeticwiper.viet69sex.blog:2086
hermeticwiper.viet69sex.blog:2095
hermeticwiper.viet69sex.blog:443
hermeticwiper.viet69sex.blog:2053
hermeticwiper.viet69sex.blog:2083
hermeticwiper.viet69sex.blog:2087
hermeticwiper.viet69sex.blog:2096
hermeticwiper.viet69sex.blog:8443
agenttesla.viet69sex.blog:80
agenttesla.viet69sex.blog:22
agenttesla.viet69sex.blog:8080
agenttesla.viet69sex.blog:8880
agenttesla.viet69sex.blog:2052
agenttesla.viet69sex.blog:2082
agenttesla.viet69sex.blog:2086
agenttesla.viet69sex.blog:2095
agenttesla.viet69sex.blog:443
agenttesla.viet69sex.blog:2053
agenttesla.viet69sex.blog:2083
agenttesla.viet69sex.blog:2087
agenttesla.viet69sex.blog:2096
agenttesla.viet69sex.blog:8443
qakbot.viet69sex.blog:80
qakbot.viet69sex.blog:22
qakbot.viet69sex.blog:8080
qakbot.viet69sex.blog:8880
qakbot.viet69sex.blog:2052
qakbot.viet69sex.blog:2082
qakbot.viet69sex.blog:2086
qakbot.viet69sex.blog:2095
qakbot.viet69sex.blog:443
qakbot.viet69sex.blog:2053
qakbot.viet69sex.blog:2083
qakbot.viet69sex.blog:2087
qakbot.viet69sex.blog:2096
qakbot.viet69sex.blog:8443

Mutex

YUZ4JS6YA3NM

Attributes

delay
0
install
true
install_file
xhzh52o2.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  acc9ee46646963467720af55875af9b180b95f28df79351b7adeb58190642c08
- Size 45KB
- SHA256 acc9ee46646963467720af55875af9b180b95f28df79351b7adeb58190642c08
- MD5 98dc8bebb245a97395c8107155e3f47f
- SHA1 ffc50a34fb6bd90bfd52bfc5db2139c2c6f9ba5e
- SHA512 512d043637486bca8103d3825329bf4a3faff18d005187a690bbbbe3d1f1d431886de50a67b0cf4bd7a0ff442419b2f0a19c424d0574eacd43382b448b155d0f
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Jw0Q+KXPIlzjb4gX3iYHOWcNhgM6ejDFKpUBDZW:cu6YepTPso229l3bvXSYHOWcdhBHdUx
- TLSH
  T1A2232A003BE8C127F2BE4FB899F26145867AF5632603DA4D2CC451DB5623FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2