asyncrat | fd1de49258ebb925a5e8bfa58970e1065eecfa6118ebaf1e6bd99e120d029e9c

Sharing

Copy URL Twitter E-mail

General

Target
fd1de49258ebb925a5e8bfa58970e1065eecfa6118ebaf1e6bd99e120d029e9c
Size 45KB
Sample260711-pbjbxabw71
SHA256 fd1de49258ebb925a5e8bfa58970e1065eecfa6118ebaf1e6bd99e120d029e9c
MD5 0589465884fda8c196491a731fda5e8a
SHA1 dde7d5b8eccb6f2804c25337edf4bec7e949d103
SHA512 9944274c8c8b8113c3dd5bba9cf905b74a31433956f3bf35ce36d8dd4ac296c8b79d7b3bc44ccf6f56d8e1f7c60d31869d1ec8bdb3e703488a04f14ff9908a8c
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9m6R8aI6OPIXzjbmgl3iwwi5yKDznw4uBDZ8x:0u1YJTHcw2Z+Fb3X3b5lSFi5pvw4gd8x
TLSH
T1C2232B0037E8822BF2BE4B789CF26245857AE5673603D58E1CC451DB5713FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexnhu.com:80
sexnhu.com:22
sexnhu.com:8080
sexnhu.com:8880
sexnhu.com:2052
sexnhu.com:2082
sexnhu.com:2086
sexnhu.com:2095
sexnhu.com:443
sexnhu.com:2053
sexnhu.com:2083
sexnhu.com:2087
sexnhu.com:2096
sexnhu.com:8443
www.sexnhu.com:80
www.sexnhu.com:22
www.sexnhu.com:8080
www.sexnhu.com:8880
www.sexnhu.com:2052
www.sexnhu.com:2082
www.sexnhu.com:2086
www.sexnhu.com:2095
www.sexnhu.com:443
www.sexnhu.com:2053
www.sexnhu.com:2083
www.sexnhu.com:2087
www.sexnhu.com:2096
www.sexnhu.com:8443
socgholish.sexnhu.com:80
socgholish.sexnhu.com:22
socgholish.sexnhu.com:8080
socgholish.sexnhu.com:8880
socgholish.sexnhu.com:2052
socgholish.sexnhu.com:2082
socgholish.sexnhu.com:2086
socgholish.sexnhu.com:2095
socgholish.sexnhu.com:443
socgholish.sexnhu.com:2053
socgholish.sexnhu.com:2083
socgholish.sexnhu.com:2087
socgholish.sexnhu.com:2096
socgholish.sexnhu.com:8443
formbook.sexnhu.com:80
formbook.sexnhu.com:22
formbook.sexnhu.com:8080
formbook.sexnhu.com:8880
formbook.sexnhu.com:2052
formbook.sexnhu.com:2082
formbook.sexnhu.com:2086
formbook.sexnhu.com:2095
formbook.sexnhu.com:443
formbook.sexnhu.com:2053
formbook.sexnhu.com:2083
formbook.sexnhu.com:2087
formbook.sexnhu.com:2096
formbook.sexnhu.com:8443
industroyer.sexnhu.com:80
industroyer.sexnhu.com:22
industroyer.sexnhu.com:8080
industroyer.sexnhu.com:8880
industroyer.sexnhu.com:2052
industroyer.sexnhu.com:2082
industroyer.sexnhu.com:2086
industroyer.sexnhu.com:2095
industroyer.sexnhu.com:443
industroyer.sexnhu.com:2053
industroyer.sexnhu.com:2083
industroyer.sexnhu.com:2087
industroyer.sexnhu.com:2096
industroyer.sexnhu.com:8443

Mutex

OwyYi8lC9KT6

Attributes

delay
0
install
true
install_file
widnwi.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  fd1de49258ebb925a5e8bfa58970e1065eecfa6118ebaf1e6bd99e120d029e9c
- Size 45KB
- SHA256 fd1de49258ebb925a5e8bfa58970e1065eecfa6118ebaf1e6bd99e120d029e9c
- MD5 0589465884fda8c196491a731fda5e8a
- SHA1 dde7d5b8eccb6f2804c25337edf4bec7e949d103
- SHA512 9944274c8c8b8113c3dd5bba9cf905b74a31433956f3bf35ce36d8dd4ac296c8b79d7b3bc44ccf6f56d8e1f7c60d31869d1ec8bdb3e703488a04f14ff9908a8c
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9m6R8aI6OPIXzjbmgl3iwwi5yKDznw4uBDZ8x:0u1YJTHcw2Z+Fb3X3b5lSFi5pvw4gd8x
- TLSH
  T1C2232B0037E8822BF2BE4B789CF26245857AE5673603D58E1CC451DB5713FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2