asyncrat | 93c18195b0ef8ecb414cdd2ca98f2f435f2886b5dd3d00bc5d11b1cb8ef0d1f6

Sharing

Copy URL Twitter E-mail

General

Target
93c18195b0ef8ecb414cdd2ca98f2f435f2886b5dd3d00bc5d11b1cb8ef0d1f6
Size 45KB
Sample260711-llff8aft9m
SHA256 93c18195b0ef8ecb414cdd2ca98f2f435f2886b5dd3d00bc5d11b1cb8ef0d1f6
MD5 7ce4d591371866a3ffca3680da7b184d
SHA1 2bf3b582c62218ba21d8dbfcb454bc3cb2a6e14f
SHA512 a8414762988d1362d75b86dda22269ffef4ce576f8c5c51990f4a7b2b1710788413cf99da56e46f1ded455eb067367fe770279364d99cdad440624e562c1c5d4
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFkhk6K7OOPIzzjbbgs3i8tMTe8mUBpS0bgJdFBDZEx:MuLAZTnbg216VO3z3bksS8tMfS0qtdEx
TLSH
T19A231B003BECC12BF2BE4F78A9F26145867AF6636603D54E1CC451DB5613FC68A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexnhu.com:80
sexnhu.com:22
sexnhu.com:8080
sexnhu.com:8880
sexnhu.com:2052
sexnhu.com:2082
sexnhu.com:2086
sexnhu.com:2095
sexnhu.com:443
sexnhu.com:2053
sexnhu.com:2083
sexnhu.com:2087
sexnhu.com:2096
sexnhu.com:8443
www.sexnhu.com:80
www.sexnhu.com:22
www.sexnhu.com:8080
www.sexnhu.com:8880
www.sexnhu.com:2052
www.sexnhu.com:2082
www.sexnhu.com:2086
www.sexnhu.com:2095
www.sexnhu.com:443
www.sexnhu.com:2053
www.sexnhu.com:2083
www.sexnhu.com:2087
www.sexnhu.com:2096
www.sexnhu.com:8443
formbook.sexnhu.com:80
formbook.sexnhu.com:22
formbook.sexnhu.com:8080
formbook.sexnhu.com:8880
formbook.sexnhu.com:2052
formbook.sexnhu.com:2082
formbook.sexnhu.com:2086
formbook.sexnhu.com:2095
formbook.sexnhu.com:443
formbook.sexnhu.com:2053
formbook.sexnhu.com:2083
formbook.sexnhu.com:2087
formbook.sexnhu.com:2096
formbook.sexnhu.com:8443
socgholish.sexnhu.com:80
socgholish.sexnhu.com:22
socgholish.sexnhu.com:8080
socgholish.sexnhu.com:8880
socgholish.sexnhu.com:2052
socgholish.sexnhu.com:2082
socgholish.sexnhu.com:2086
socgholish.sexnhu.com:2095
socgholish.sexnhu.com:443
socgholish.sexnhu.com:2053
socgholish.sexnhu.com:2083
socgholish.sexnhu.com:2087
socgholish.sexnhu.com:2096
socgholish.sexnhu.com:8443
cl0p.sexnhu.com:80
cl0p.sexnhu.com:22
cl0p.sexnhu.com:8080
cl0p.sexnhu.com:8880
cl0p.sexnhu.com:2052
cl0p.sexnhu.com:2082
cl0p.sexnhu.com:2086
cl0p.sexnhu.com:2095
cl0p.sexnhu.com:443
cl0p.sexnhu.com:2053
cl0p.sexnhu.com:2083
cl0p.sexnhu.com:2087
cl0p.sexnhu.com:2096
cl0p.sexnhu.com:8443
industroyer.sexnhu.com:80
industroyer.sexnhu.com:22
industroyer.sexnhu.com:8080
industroyer.sexnhu.com:8880
industroyer.sexnhu.com:2052
industroyer.sexnhu.com:2082
industroyer.sexnhu.com:2086
industroyer.sexnhu.com:2095
industroyer.sexnhu.com:443
industroyer.sexnhu.com:2053
industroyer.sexnhu.com:2083
industroyer.sexnhu.com:2087
industroyer.sexnhu.com:2096
industroyer.sexnhu.com:8443

Mutex

v0AV06BHD8Ur

Attributes

delay
0
install
true
install_file
fxk2h.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  93c18195b0ef8ecb414cdd2ca98f2f435f2886b5dd3d00bc5d11b1cb8ef0d1f6
- Size 45KB
- SHA256 93c18195b0ef8ecb414cdd2ca98f2f435f2886b5dd3d00bc5d11b1cb8ef0d1f6
- MD5 7ce4d591371866a3ffca3680da7b184d
- SHA1 2bf3b582c62218ba21d8dbfcb454bc3cb2a6e14f
- SHA512 a8414762988d1362d75b86dda22269ffef4ce576f8c5c51990f4a7b2b1710788413cf99da56e46f1ded455eb067367fe770279364d99cdad440624e562c1c5d4
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFkhk6K7OOPIzzjbbgs3i8tMTe8mUBpS0bgJdFBDZEx:MuLAZTnbg216VO3z3bksS8tMfS0qtdEx
- TLSH
  T19A231B003BECC12BF2BE4F78A9F26145867AF6636603D54E1CC451DB5613FC68A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2