asyncrat | 646361433ebbc191f74ba83a630b6431dee2a1da241fd12564efe6dc056fb896

Sharing

Copy URL Twitter E-mail

General

Target
646361433ebbc191f74ba83a630b6431dee2a1da241fd12564efe6dc056fb896
Size 45KB
Sample260712-t7xxdsfv2v
SHA256 646361433ebbc191f74ba83a630b6431dee2a1da241fd12564efe6dc056fb896
MD5 5c00544744ab33a2b697bd1105abb41a
SHA1 76740b3833cd400eb07cb2ce75081d37ddc5980c
SHA512 9a7a216d66cc0ada307a5c459c0983926a931f27edb92a58d78eb50fad867133495783690ff0a71353f8961968c45a71da9d70f7eaf81f2b1f3b912fb6883f0d
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCM+d4CvS8PIMbjbIgX3ivyQ6lTNWGT8V5BDZO:kuSOpTPOP2x/CFWBMPbfXSqQ+TgGAVn8
TLSH
T187233B0037E9812BF6BE4F74A9F25245867AF6632603D54D1CC441DB5A23FC68A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s1.viet69sex.blog:80
s1.viet69sex.blog:22
s1.viet69sex.blog:8080
s1.viet69sex.blog:8880
s1.viet69sex.blog:2052
s1.viet69sex.blog:2082
s1.viet69sex.blog:2086
s1.viet69sex.blog:2095
s1.viet69sex.blog:443
s1.viet69sex.blog:2053
s1.viet69sex.blog:2083
s1.viet69sex.blog:2087
s1.viet69sex.blog:2096
s1.viet69sex.blog:8443
www.s1.viet69sex.blog:80
www.s1.viet69sex.blog:22
www.s1.viet69sex.blog:8080
www.s1.viet69sex.blog:8880
www.s1.viet69sex.blog:2052
www.s1.viet69sex.blog:2082
www.s1.viet69sex.blog:2086
www.s1.viet69sex.blog:2095
www.s1.viet69sex.blog:443
www.s1.viet69sex.blog:2053
www.s1.viet69sex.blog:2083
www.s1.viet69sex.blog:2087
www.s1.viet69sex.blog:2096
www.s1.viet69sex.blog:8443
locky.s1.viet69sex.blog:80
locky.s1.viet69sex.blog:22
locky.s1.viet69sex.blog:8080
locky.s1.viet69sex.blog:8880
locky.s1.viet69sex.blog:2052
locky.s1.viet69sex.blog:2082
locky.s1.viet69sex.blog:2086
locky.s1.viet69sex.blog:2095
locky.s1.viet69sex.blog:443
locky.s1.viet69sex.blog:2053
locky.s1.viet69sex.blog:2083
locky.s1.viet69sex.blog:2087
locky.s1.viet69sex.blog:2096
locky.s1.viet69sex.blog:8443
conti.s1.viet69sex.blog:80
conti.s1.viet69sex.blog:22
conti.s1.viet69sex.blog:8080
conti.s1.viet69sex.blog:8880
conti.s1.viet69sex.blog:2052
conti.s1.viet69sex.blog:2082
conti.s1.viet69sex.blog:2086
conti.s1.viet69sex.blog:2095
conti.s1.viet69sex.blog:443
conti.s1.viet69sex.blog:2053
conti.s1.viet69sex.blog:2083
conti.s1.viet69sex.blog:2087
conti.s1.viet69sex.blog:2096
conti.s1.viet69sex.blog:8443
notpetya.s1.viet69sex.blog:80
notpetya.s1.viet69sex.blog:22
notpetya.s1.viet69sex.blog:8080
notpetya.s1.viet69sex.blog:8880
notpetya.s1.viet69sex.blog:2052
notpetya.s1.viet69sex.blog:2082
notpetya.s1.viet69sex.blog:2086
notpetya.s1.viet69sex.blog:2095
notpetya.s1.viet69sex.blog:443
notpetya.s1.viet69sex.blog:2053
notpetya.s1.viet69sex.blog:2083
notpetya.s1.viet69sex.blog:2087
notpetya.s1.viet69sex.blog:2096
notpetya.s1.viet69sex.blog:8443

Mutex

JKqqEtzxk8n8

Attributes

delay
0
install
true
install_file
mwwa.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  646361433ebbc191f74ba83a630b6431dee2a1da241fd12564efe6dc056fb896
- Size 45KB
- SHA256 646361433ebbc191f74ba83a630b6431dee2a1da241fd12564efe6dc056fb896
- MD5 5c00544744ab33a2b697bd1105abb41a
- SHA1 76740b3833cd400eb07cb2ce75081d37ddc5980c
- SHA512 9a7a216d66cc0ada307a5c459c0983926a931f27edb92a58d78eb50fad867133495783690ff0a71353f8961968c45a71da9d70f7eaf81f2b1f3b912fb6883f0d
- SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCM+d4CvS8PIMbjbIgX3ivyQ6lTNWGT8V5BDZO:kuSOpTPOP2x/CFWBMPbfXSqQ+TgGAVn8
- TLSH
  T187233B0037E9812BF6BE4F74A9F25245867AF6632603D54D1CC441DB5A23FC68A43AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2