asyncrat | 39ade5901ac1665d8141ebbf1687453c807526c5c6bdd9a5305e5c31f6948298

Sharing

Copy URL Twitter E-mail

General

Target
39ade5901ac1665d8141ebbf1687453c807526c5c6bdd9a5305e5c31f6948298
Size 45KB
Sample260710-k63a2sgw4q
SHA256 39ade5901ac1665d8141ebbf1687453c807526c5c6bdd9a5305e5c31f6948298
MD5 6090506618f0b90cd1c640c5302279a8
SHA1 a2972962eec276e36f900fc263adf16fb18e47cf
SHA512 a3f2dbecb011dcd810dc9dbd99cf5d940120918e32dfc5e370c7f11a53360791a2471ffe0657f742f45c3f4669afd163635fabc2255c20658dff4f385f3bf1ef
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3xY6AZOOPILzjbig13id+iQaji00UlUSBDZUx:cu7e5TH2A2kulO3L3bF1SVjR0U+sdUx
TLSH
T1B4231A003BE8822BF27E4F74ADF26145867AF6B37603D5491CC452DB5613BC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexviet74.com:80
sexviet74.com:22
sexviet74.com:8080
sexviet74.com:8880
sexviet74.com:2052
sexviet74.com:2082
sexviet74.com:2086
sexviet74.com:2095
sexviet74.com:443
sexviet74.com:2053
sexviet74.com:2083
sexviet74.com:2087
sexviet74.com:2096
sexviet74.com:8443
www.sexviet74.com:80
www.sexviet74.com:22
www.sexviet74.com:8080
www.sexviet74.com:8880
www.sexviet74.com:2052
www.sexviet74.com:2082
www.sexviet74.com:2086
www.sexviet74.com:2095
www.sexviet74.com:443
www.sexviet74.com:2053
www.sexviet74.com:2083
www.sexviet74.com:2087
www.sexviet74.com:2096
www.sexviet74.com:8443
clop.sexviet74.com:80
clop.sexviet74.com:22
clop.sexviet74.com:8080
clop.sexviet74.com:8880
clop.sexviet74.com:2052
clop.sexviet74.com:2082
clop.sexviet74.com:2086
clop.sexviet74.com:2095
clop.sexviet74.com:443
clop.sexviet74.com:2053
clop.sexviet74.com:2083
clop.sexviet74.com:2087
clop.sexviet74.com:2096
clop.sexviet74.com:8443
gh0st.sexviet74.com:80
gh0st.sexviet74.com:22
gh0st.sexviet74.com:8080
gh0st.sexviet74.com:8880
gh0st.sexviet74.com:2052
gh0st.sexviet74.com:2082
gh0st.sexviet74.com:2086
gh0st.sexviet74.com:2095
gh0st.sexviet74.com:443
gh0st.sexviet74.com:2053
gh0st.sexviet74.com:2083
gh0st.sexviet74.com:2087
gh0st.sexviet74.com:2096
gh0st.sexviet74.com:8443
sodinokibi.sexviet74.com:80
sodinokibi.sexviet74.com:22
sodinokibi.sexviet74.com:8080
sodinokibi.sexviet74.com:8880
sodinokibi.sexviet74.com:2052
sodinokibi.sexviet74.com:2082
sodinokibi.sexviet74.com:2086
sodinokibi.sexviet74.com:2095
sodinokibi.sexviet74.com:443
sodinokibi.sexviet74.com:2053
sodinokibi.sexviet74.com:2083
sodinokibi.sexviet74.com:2087
sodinokibi.sexviet74.com:2096
sodinokibi.sexviet74.com:8443

Mutex

bDfHJlrbQ8C2

Attributes

delay
0
install
true
install_file
3kvhj.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  39ade5901ac1665d8141ebbf1687453c807526c5c6bdd9a5305e5c31f6948298
- Size 45KB
- SHA256 39ade5901ac1665d8141ebbf1687453c807526c5c6bdd9a5305e5c31f6948298
- MD5 6090506618f0b90cd1c640c5302279a8
- SHA1 a2972962eec276e36f900fc263adf16fb18e47cf
- SHA512 a3f2dbecb011dcd810dc9dbd99cf5d940120918e32dfc5e370c7f11a53360791a2471ffe0657f742f45c3f4669afd163635fabc2255c20658dff4f385f3bf1ef
- SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3xY6AZOOPILzjbig13id+iQaji00UlUSBDZUx:cu7e5TH2A2kulO3L3bF1SVjR0U+sdUx
- TLSH
  T1B4231A003BE8822BF27E4F74ADF26145867AF6B37603D5491CC452DB5613BC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2