asyncrat | 0918a7b679a8f6e0db863944c51220cc33484b2624c6b6663a58b4e5f6ca6e84

Sharing

Copy URL Twitter E-mail

General

Target
0918a7b679a8f6e0db863944c51220cc33484b2624c6b6663a58b4e5f6ca6e84
Size 45KB
Sample260712-dr3jyact9q
SHA256 0918a7b679a8f6e0db863944c51220cc33484b2624c6b6663a58b4e5f6ca6e84
MD5 e8ab400c729d645db5c6a9d3b1df136e
SHA1 4575f17e86f46d327919efc26ec251e6f952014d
SHA512 f498adf6c3da37947aaac352b2747265c55d34631fb5d5a700c03d52f13bdc91d6a163252fdeeeabf522a46273fa902b21449caa9fbf819370e8fe9cb5aeafcc
SSDEEP 768:EulCJTHESwgWUK3aGmo2q95oRQKISOPINzjbEgn3iExGpdgQFpD4zHsuBDZsx:EulCJTHl42mYxz3N3bLnSxJD4wgdsx
TLSH
T1F92329003BE8822BF2BE4F78A8F26145467AF6673A03E54D1C84519B5613FC6DA426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexviet11.com:80
sexviet11.com:22
sexviet11.com:8080
sexviet11.com:8880
sexviet11.com:2052
sexviet11.com:2082
sexviet11.com:2086
sexviet11.com:2095
sexviet11.com:443
sexviet11.com:2053
sexviet11.com:2083
sexviet11.com:2087
sexviet11.com:2096
sexviet11.com:8443
www.sexviet11.com:80
www.sexviet11.com:22
www.sexviet11.com:8080
www.sexviet11.com:8880
www.sexviet11.com:2052
www.sexviet11.com:2082
www.sexviet11.com:2086
www.sexviet11.com:2095
www.sexviet11.com:443
www.sexviet11.com:2053
www.sexviet11.com:2083
www.sexviet11.com:2087
www.sexviet11.com:2096
www.sexviet11.com:8443
lokibot.sexviet11.com:80
lokibot.sexviet11.com:22
lokibot.sexviet11.com:8080
lokibot.sexviet11.com:8880
lokibot.sexviet11.com:2052
lokibot.sexviet11.com:2082
lokibot.sexviet11.com:2086
lokibot.sexviet11.com:2095
lokibot.sexviet11.com:443
lokibot.sexviet11.com:2053
lokibot.sexviet11.com:2083
lokibot.sexviet11.com:2087
lokibot.sexviet11.com:2096
lokibot.sexviet11.com:8443
connect.sexviet11.com:80
connect.sexviet11.com:22
connect.sexviet11.com:8080
connect.sexviet11.com:8880
connect.sexviet11.com:2052
connect.sexviet11.com:2082
connect.sexviet11.com:2086
connect.sexviet11.com:2095
connect.sexviet11.com:443
connect.sexviet11.com:2053
connect.sexviet11.com:2083
connect.sexviet11.com:2087
connect.sexviet11.com:2096
connect.sexviet11.com:8443
darkside.sexviet11.com:80
darkside.sexviet11.com:22
darkside.sexviet11.com:8080
darkside.sexviet11.com:8880
darkside.sexviet11.com:2052
darkside.sexviet11.com:2082
darkside.sexviet11.com:2086
darkside.sexviet11.com:2095
darkside.sexviet11.com:443
darkside.sexviet11.com:2053
darkside.sexviet11.com:2083
darkside.sexviet11.com:2087
darkside.sexviet11.com:2096
darkside.sexviet11.com:8443

Mutex

F5h5ybAkwOjU

Attributes

delay
0
install
true
install_file
oqv2qg.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  0918a7b679a8f6e0db863944c51220cc33484b2624c6b6663a58b4e5f6ca6e84
- Size 45KB
- SHA256 0918a7b679a8f6e0db863944c51220cc33484b2624c6b6663a58b4e5f6ca6e84
- MD5 e8ab400c729d645db5c6a9d3b1df136e
- SHA1 4575f17e86f46d327919efc26ec251e6f952014d
- SHA512 f498adf6c3da37947aaac352b2747265c55d34631fb5d5a700c03d52f13bdc91d6a163252fdeeeabf522a46273fa902b21449caa9fbf819370e8fe9cb5aeafcc
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q95oRQKISOPINzjbEgn3iExGpdgQFpD4zHsuBDZsx:EulCJTHl42mYxz3N3bLnSxJD4wgdsx
- TLSH
  T1F92329003BE8822BF2BE4F78A8F26145467AF6673A03E54D1C84519B5613FC6DA426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2