asyncrat | 4c84dd5f46229f9fd3674496390fac4f8a8776b5f5b74a09f61aa505d88e74f5

Sharing

Copy URL Twitter E-mail

General

Target
4c84dd5f46229f9fd3674496390fac4f8a8776b5f5b74a09f61aa505d88e74f5
Size 45KB
Sample260707-vg5d8aas6z
SHA256 4c84dd5f46229f9fd3674496390fac4f8a8776b5f5b74a09f61aa505d88e74f5
MD5 ee358ca988eb9ba9750621398eaa9d5a
SHA1 add6ec0550687509481242b087330b321f7483ae
SHA512 af6cc0f5393a0be85df0f78e29761853c0875597192ba62eaec2297642513c3bcc6c947544640e758251af65626a974f1d481d3f790e0780cc5257b28c1daf12
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtDc30oiZPI/zjbUgX3ik+4g5h7sKAcBDZEx:MuBGJTPho2twR2iW/3b7XSkbg5h3LdEx
TLSH
T17A232A0037E9C12BF2BE4F7869F26145867AF6633603D5491CC451DB0A23BC69A43AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vlxxzz.net:80
vlxxzz.net:22
vlxxzz.net:8080
vlxxzz.net:8880
vlxxzz.net:2052
vlxxzz.net:2082
vlxxzz.net:2086
vlxxzz.net:2095
vlxxzz.net:443
vlxxzz.net:2053
vlxxzz.net:2083
vlxxzz.net:2087
vlxxzz.net:2096
vlxxzz.net:8443
www.vlxxzz.net:80
www.vlxxzz.net:22
www.vlxxzz.net:8080
www.vlxxzz.net:8880
www.vlxxzz.net:2052
www.vlxxzz.net:2082
www.vlxxzz.net:2086
www.vlxxzz.net:2095
www.vlxxzz.net:443
www.vlxxzz.net:2053
www.vlxxzz.net:2083
www.vlxxzz.net:2087
www.vlxxzz.net:2096
www.vlxxzz.net:8443
stuxnet.vlxxzz.net:80
stuxnet.vlxxzz.net:22
stuxnet.vlxxzz.net:8080
stuxnet.vlxxzz.net:8880
stuxnet.vlxxzz.net:2052
stuxnet.vlxxzz.net:2082
stuxnet.vlxxzz.net:2086
stuxnet.vlxxzz.net:2095
stuxnet.vlxxzz.net:443
stuxnet.vlxxzz.net:2053
stuxnet.vlxxzz.net:2083
stuxnet.vlxxzz.net:2087
stuxnet.vlxxzz.net:2096
stuxnet.vlxxzz.net:8443
notpetya.vlxxzz.net:80
notpetya.vlxxzz.net:22
notpetya.vlxxzz.net:8080
notpetya.vlxxzz.net:8880
notpetya.vlxxzz.net:2052
notpetya.vlxxzz.net:2082
notpetya.vlxxzz.net:2086
notpetya.vlxxzz.net:2095
notpetya.vlxxzz.net:443
notpetya.vlxxzz.net:2053
notpetya.vlxxzz.net:2083
notpetya.vlxxzz.net:2087
notpetya.vlxxzz.net:2096
notpetya.vlxxzz.net:8443
remote.vlxxzz.net:80
remote.vlxxzz.net:22
remote.vlxxzz.net:8080
remote.vlxxzz.net:8880
remote.vlxxzz.net:2052
remote.vlxxzz.net:2082
remote.vlxxzz.net:2086
remote.vlxxzz.net:2095
remote.vlxxzz.net:443
remote.vlxxzz.net:2053
remote.vlxxzz.net:2083
remote.vlxxzz.net:2087
remote.vlxxzz.net:2096
remote.vlxxzz.net:8443
darkside.vlxxzz.net:80
darkside.vlxxzz.net:22
darkside.vlxxzz.net:8080
darkside.vlxxzz.net:8880
darkside.vlxxzz.net:2052
darkside.vlxxzz.net:2082
darkside.vlxxzz.net:2086
darkside.vlxxzz.net:2095
darkside.vlxxzz.net:443
darkside.vlxxzz.net:2053
darkside.vlxxzz.net:2083
darkside.vlxxzz.net:2087
darkside.vlxxzz.net:2096
darkside.vlxxzz.net:8443

Mutex

mNDOajFosGxf

Attributes

delay
0
install
true
install_file
r1xf.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4c84dd5f46229f9fd3674496390fac4f8a8776b5f5b74a09f61aa505d88e74f5
- Size 45KB
- SHA256 4c84dd5f46229f9fd3674496390fac4f8a8776b5f5b74a09f61aa505d88e74f5
- MD5 ee358ca988eb9ba9750621398eaa9d5a
- SHA1 add6ec0550687509481242b087330b321f7483ae
- SHA512 af6cc0f5393a0be85df0f78e29761853c0875597192ba62eaec2297642513c3bcc6c947544640e758251af65626a974f1d481d3f790e0780cc5257b28c1daf12
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtDc30oiZPI/zjbUgX3ik+4g5h7sKAcBDZEx:MuBGJTPho2twR2iW/3b7XSkbg5h3LdEx
- TLSH
  T17A232A0037E9C12BF2BE4F7869F26145867AF6633603D5491CC451DB0A23BC69A43AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2