asyncrat | 0ccf9388016414b786cf6dfd6ef0e7e1f3d204104220175dbc2d0a88666162fb

Sharing

Copy URL Twitter E-mail

General

Target
0ccf9388016414b786cf6dfd6ef0e7e1f3d204104220175dbc2d0a88666162fb
Size 45KB
Sample260711-mtckzagt7l
SHA256 0ccf9388016414b786cf6dfd6ef0e7e1f3d204104220175dbc2d0a88666162fb
MD5 e0cc235381dadeb5749f9a5c93598a5c
SHA1 06af2dd23432a6d4b8bb1415bb081b52fe2f52bb
SHA512 e2123955248579a17ab42d00dce8116fffbf1e319b0e33b0ce9dd577e9d7ce5352015ab9fab74178af3b9bcdab9c18daa76830b289ab06f327b7298012517e8e
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMSPI58jbjRgX3iczYMR1isBDZsx:EulCJTHl42agG5MbjeXSc5dsx
TLSH
T1E8231A003BE8C13BF2BE5F7899F25146867AF6633A03D54A1CC4419A5623FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexnhu.com:80
sexnhu.com:22
sexnhu.com:8080
sexnhu.com:8880
sexnhu.com:2052
sexnhu.com:2082
sexnhu.com:2086
sexnhu.com:2095
sexnhu.com:443
sexnhu.com:2053
sexnhu.com:2083
sexnhu.com:2087
sexnhu.com:2096
sexnhu.com:8443
www.sexnhu.com:80
www.sexnhu.com:22
www.sexnhu.com:8080
www.sexnhu.com:8880
www.sexnhu.com:2052
www.sexnhu.com:2082
www.sexnhu.com:2086
www.sexnhu.com:2095
www.sexnhu.com:443
www.sexnhu.com:2053
www.sexnhu.com:2083
www.sexnhu.com:2087
www.sexnhu.com:2096
www.sexnhu.com:8443
remote.sexnhu.com:80
remote.sexnhu.com:22
remote.sexnhu.com:8080
remote.sexnhu.com:8880
remote.sexnhu.com:2052
remote.sexnhu.com:2082
remote.sexnhu.com:2086
remote.sexnhu.com:2095
remote.sexnhu.com:443
remote.sexnhu.com:2053
remote.sexnhu.com:2083
remote.sexnhu.com:2087
remote.sexnhu.com:2096
remote.sexnhu.com:8443
klez.sexnhu.com:80
klez.sexnhu.com:22
klez.sexnhu.com:8080
klez.sexnhu.com:8880
klez.sexnhu.com:2052
klez.sexnhu.com:2082
klez.sexnhu.com:2086
klez.sexnhu.com:2095
klez.sexnhu.com:443
klez.sexnhu.com:2053
klez.sexnhu.com:2083
klez.sexnhu.com:2087
klez.sexnhu.com:2096
klez.sexnhu.com:8443
cryptolocker.sexnhu.com:80
cryptolocker.sexnhu.com:22
cryptolocker.sexnhu.com:8080
cryptolocker.sexnhu.com:8880
cryptolocker.sexnhu.com:2052
cryptolocker.sexnhu.com:2082
cryptolocker.sexnhu.com:2086
cryptolocker.sexnhu.com:2095
cryptolocker.sexnhu.com:443
cryptolocker.sexnhu.com:2053
cryptolocker.sexnhu.com:2083
cryptolocker.sexnhu.com:2087
cryptolocker.sexnhu.com:2096
cryptolocker.sexnhu.com:8443
lokibot.sexnhu.com:80
lokibot.sexnhu.com:22
lokibot.sexnhu.com:8080
lokibot.sexnhu.com:8880
lokibot.sexnhu.com:2052
lokibot.sexnhu.com:2082
lokibot.sexnhu.com:2086
lokibot.sexnhu.com:2095
lokibot.sexnhu.com:443
lokibot.sexnhu.com:2053
lokibot.sexnhu.com:2083
lokibot.sexnhu.com:2087
lokibot.sexnhu.com:2096
lokibot.sexnhu.com:8443

Mutex

vzUhy0IJEgkm

Attributes

delay
0
install
true
install_file
uj6o89.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  0ccf9388016414b786cf6dfd6ef0e7e1f3d204104220175dbc2d0a88666162fb
- Size 45KB
- SHA256 0ccf9388016414b786cf6dfd6ef0e7e1f3d204104220175dbc2d0a88666162fb
- MD5 e0cc235381dadeb5749f9a5c93598a5c
- SHA1 06af2dd23432a6d4b8bb1415bb081b52fe2f52bb
- SHA512 e2123955248579a17ab42d00dce8116fffbf1e319b0e33b0ce9dd577e9d7ce5352015ab9fab74178af3b9bcdab9c18daa76830b289ab06f327b7298012517e8e
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMSPI58jbjRgX3iczYMR1isBDZsx:EulCJTHl42agG5MbjeXSc5dsx
- TLSH
  T1E8231A003BE8C13BF2BE5F7899F25146867AF6633A03D54A1CC4419A5623FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2