asyncrat | 8ff661aa70b8ef5049d1f9625a165d3f69d9717495e4b2e9949e8a70d3e7e105

Sharing

Copy URL Twitter E-mail

General

Target
8ff661aa70b8ef5049d1f9625a165d3f69d9717495e4b2e9949e8a70d3e7e105
Size 45KB
Sample260711-s1v9jsfx2v
SHA256 8ff661aa70b8ef5049d1f9625a165d3f69d9717495e4b2e9949e8a70d3e7e105
MD5 f797dc87a14b3afe4b9a0835a7143c2a
SHA1 9950afceaef61a4f873877f063b24cb3940ecde8
SHA512 2c322c4e4f130b95f248c576bb57ad50c6ae8c3055e58160f8cd1ca193b13c1f1ae46a9fa0ec513925adb0ec0b2b85723b76b07d66e591ecb39479048c60b9dd
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMSPI5mjbPgX3iVI0ZrnJZ9vBDZ0x:8uuSpTgyf2dgG5Kb4XSVrJtd0x
TLSH
T177232A003BE8812BF2BE5B7899F26145867AF6673703D54E2CC4419B5723FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexvietnew.info:80
sexvietnew.info:22
sexvietnew.info:8080
sexvietnew.info:8880
sexvietnew.info:2052
sexvietnew.info:2082
sexvietnew.info:2086
sexvietnew.info:2095
sexvietnew.info:443
sexvietnew.info:2053
sexvietnew.info:2083
sexvietnew.info:2087
sexvietnew.info:2096
sexvietnew.info:8443
www.sexvietnew.info:80
www.sexvietnew.info:22
www.sexvietnew.info:8080
www.sexvietnew.info:8880
www.sexvietnew.info:2052
www.sexvietnew.info:2082
www.sexvietnew.info:2086
www.sexvietnew.info:2095
www.sexvietnew.info:443
www.sexvietnew.info:2053
www.sexvietnew.info:2083
www.sexvietnew.info:2087
www.sexvietnew.info:2096
www.sexvietnew.info:8443
locky.sexvietnew.info:80
locky.sexvietnew.info:22
locky.sexvietnew.info:8080
locky.sexvietnew.info:8880
locky.sexvietnew.info:2052
locky.sexvietnew.info:2082
locky.sexvietnew.info:2086
locky.sexvietnew.info:2095
locky.sexvietnew.info:443
locky.sexvietnew.info:2053
locky.sexvietnew.info:2083
locky.sexvietnew.info:2087
locky.sexvietnew.info:2096
locky.sexvietnew.info:8443
dridex.sexvietnew.info:80
dridex.sexvietnew.info:22
dridex.sexvietnew.info:8080
dridex.sexvietnew.info:8880
dridex.sexvietnew.info:2052
dridex.sexvietnew.info:2082
dridex.sexvietnew.info:2086
dridex.sexvietnew.info:2095
dridex.sexvietnew.info:443
dridex.sexvietnew.info:2053
dridex.sexvietnew.info:2083
dridex.sexvietnew.info:2087
dridex.sexvietnew.info:2096
dridex.sexvietnew.info:8443
downadup.sexvietnew.info:80
downadup.sexvietnew.info:22
downadup.sexvietnew.info:8080
downadup.sexvietnew.info:8880
downadup.sexvietnew.info:2052
downadup.sexvietnew.info:2082
downadup.sexvietnew.info:2086
downadup.sexvietnew.info:2095
downadup.sexvietnew.info:443
downadup.sexvietnew.info:2053
downadup.sexvietnew.info:2083
downadup.sexvietnew.info:2087
downadup.sexvietnew.info:2096
downadup.sexvietnew.info:8443
zbot.sexvietnew.info:80
zbot.sexvietnew.info:22
zbot.sexvietnew.info:8080
zbot.sexvietnew.info:8880
zbot.sexvietnew.info:2052
zbot.sexvietnew.info:2082
zbot.sexvietnew.info:2086
zbot.sexvietnew.info:2095
zbot.sexvietnew.info:443
zbot.sexvietnew.info:2053
zbot.sexvietnew.info:2083
zbot.sexvietnew.info:2087
zbot.sexvietnew.info:2096
zbot.sexvietnew.info:8443

Mutex

ha3uNrvSXxxn

Attributes

delay
0
install
true
install_file
pzyco8.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  8ff661aa70b8ef5049d1f9625a165d3f69d9717495e4b2e9949e8a70d3e7e105
- Size 45KB
- SHA256 8ff661aa70b8ef5049d1f9625a165d3f69d9717495e4b2e9949e8a70d3e7e105
- MD5 f797dc87a14b3afe4b9a0835a7143c2a
- SHA1 9950afceaef61a4f873877f063b24cb3940ecde8
- SHA512 2c322c4e4f130b95f248c576bb57ad50c6ae8c3055e58160f8cd1ca193b13c1f1ae46a9fa0ec513925adb0ec0b2b85723b76b07d66e591ecb39479048c60b9dd
- SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMSPI5mjbPgX3iVI0ZrnJZ9vBDZ0x:8uuSpTgyf2dgG5Kb4XSVrJtd0x
- TLSH
  T177232A003BE8812BF2BE5B7899F26145867AF6673703D54E2CC4419B5723FC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2