asyncrat | 840134feb538dd2458653bb07b78a07ed1cba7ea5238e156a576d5e5b19ecdb2

Sharing

Copy URL Twitter E-mail

General

Target
840134feb538dd2458653bb07b78a07ed1cba7ea5238e156a576d5e5b19ecdb2
Size 45KB
Sample260711-ngd4pshs2r
SHA256 840134feb538dd2458653bb07b78a07ed1cba7ea5238e156a576d5e5b19ecdb2
MD5 fbfe6a3bd831dcc076de70df3293a209
SHA1 8fe7c556d43518d98df88e645a354df827385832
SHA512 8bff6a8083d1f2ccf18b3135a9f9af79d2a71bd93ea0a8a04a4abb1c4827b13359c20af8e8baa60c2c792ffbb93d5b3c453a0e311749b7a8c496fc189f283de1
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1suwZQaKkPI8zjbWgX3iBraN8zBDZUx:cu6YepTPso2/I83bJXSBY8VdUx
TLSH
T1C4231A003BE8823AF2BE4FB898F26145867AF5636603D94D6CC411D75623FC696426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexvietnew.info:80
sexvietnew.info:22
sexvietnew.info:8080
sexvietnew.info:8880
sexvietnew.info:2052
sexvietnew.info:2082
sexvietnew.info:2086
sexvietnew.info:2095
sexvietnew.info:443
sexvietnew.info:2053
sexvietnew.info:2083
sexvietnew.info:2087
sexvietnew.info:2096
sexvietnew.info:8443
www.sexvietnew.info:80
www.sexvietnew.info:22
www.sexvietnew.info:8080
www.sexvietnew.info:8880
www.sexvietnew.info:2052
www.sexvietnew.info:2082
www.sexvietnew.info:2086
www.sexvietnew.info:2095
www.sexvietnew.info:443
www.sexvietnew.info:2053
www.sexvietnew.info:2083
www.sexvietnew.info:2087
www.sexvietnew.info:2096
www.sexvietnew.info:8443
downadup.sexvietnew.info:80
downadup.sexvietnew.info:22
downadup.sexvietnew.info:8080
downadup.sexvietnew.info:8880
downadup.sexvietnew.info:2052
downadup.sexvietnew.info:2082
downadup.sexvietnew.info:2086
downadup.sexvietnew.info:2095
downadup.sexvietnew.info:443
downadup.sexvietnew.info:2053
downadup.sexvietnew.info:2083
downadup.sexvietnew.info:2087
downadup.sexvietnew.info:2096
downadup.sexvietnew.info:8443
sobig.sexvietnew.info:80
sobig.sexvietnew.info:22
sobig.sexvietnew.info:8080
sobig.sexvietnew.info:8880
sobig.sexvietnew.info:2052
sobig.sexvietnew.info:2082
sobig.sexvietnew.info:2086
sobig.sexvietnew.info:2095
sobig.sexvietnew.info:443
sobig.sexvietnew.info:2053
sobig.sexvietnew.info:2083
sobig.sexvietnew.info:2087
sobig.sexvietnew.info:2096
sobig.sexvietnew.info:8443
klez.sexvietnew.info:80
klez.sexvietnew.info:22
klez.sexvietnew.info:8080
klez.sexvietnew.info:8880
klez.sexvietnew.info:2052
klez.sexvietnew.info:2082
klez.sexvietnew.info:2086
klez.sexvietnew.info:2095
klez.sexvietnew.info:443
klez.sexvietnew.info:2053
klez.sexvietnew.info:2083
klez.sexvietnew.info:2087
klez.sexvietnew.info:2096
klez.sexvietnew.info:8443

Mutex

SBox275r8W1H

Attributes

delay
0
install
true
install_file
9v62cxj0.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  840134feb538dd2458653bb07b78a07ed1cba7ea5238e156a576d5e5b19ecdb2
- Size 45KB
- SHA256 840134feb538dd2458653bb07b78a07ed1cba7ea5238e156a576d5e5b19ecdb2
- MD5 fbfe6a3bd831dcc076de70df3293a209
- SHA1 8fe7c556d43518d98df88e645a354df827385832
- SHA512 8bff6a8083d1f2ccf18b3135a9f9af79d2a71bd93ea0a8a04a4abb1c4827b13359c20af8e8baa60c2c792ffbb93d5b3c453a0e311749b7a8c496fc189f283de1
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1suwZQaKkPI8zjbWgX3iBraN8zBDZUx:cu6YepTPso2/I83bJXSBY8VdUx
- TLSH
  T1C4231A003BE8823AF2BE4FB898F26145867AF5636603D94D6CC411D75623FC696426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2