asyncrat | cfdd33f38b470cb38bccf6edb5d6d48601368b9358468dbd40c8dd16546a9c3a

Sharing

Copy URL Twitter E-mail

General

Target
cfdd33f38b470cb38bccf6edb5d6d48601368b9358468dbd40c8dd16546a9c3a
Size 45KB
Sample260712-vftlbsdx6q
SHA256 cfdd33f38b470cb38bccf6edb5d6d48601368b9358468dbd40c8dd16546a9c3a
MD5 d2ea6e6dc60120dfbfa227869b8a6b98
SHA1 23ce25726379bf936592b9e6fd60c10927f26bdb
SHA512 767b1e97842de8b177cfb2be9fb8bca2f7ac178f0d984c80850de213fc987a650a26dc0bc93a7522e2c7a47fb9901cbdde9f0e3115edbc6728d37bb8014bc5f6
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9L583IkOPIdzjb8gr3iXAF7f1GKh6YBDZsx:EulCJTHl42cAF3d3bTrSwF7fAGdsx
TLSH
T153231A003BE8812BF2BE4F789DF25145867AF6673603E54E1CC4519B5623BC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexdeplon.blog:80
sexdeplon.blog:22
sexdeplon.blog:8080
sexdeplon.blog:8880
sexdeplon.blog:2052
sexdeplon.blog:2082
sexdeplon.blog:2086
sexdeplon.blog:2095
sexdeplon.blog:443
sexdeplon.blog:2053
sexdeplon.blog:2083
sexdeplon.blog:2087
sexdeplon.blog:2096
sexdeplon.blog:8443
www.sexdeplon.blog:80
www.sexdeplon.blog:22
www.sexdeplon.blog:8080
www.sexdeplon.blog:8880
www.sexdeplon.blog:2052
www.sexdeplon.blog:2082
www.sexdeplon.blog:2086
www.sexdeplon.blog:2095
www.sexdeplon.blog:443
www.sexdeplon.blog:2053
www.sexdeplon.blog:2083
www.sexdeplon.blog:2087
www.sexdeplon.blog:2096
www.sexdeplon.blog:8443
industroyer.sexdeplon.blog:80
industroyer.sexdeplon.blog:22
industroyer.sexdeplon.blog:8080
industroyer.sexdeplon.blog:8880
industroyer.sexdeplon.blog:2052
industroyer.sexdeplon.blog:2082
industroyer.sexdeplon.blog:2086
industroyer.sexdeplon.blog:2095
industroyer.sexdeplon.blog:443
industroyer.sexdeplon.blog:2053
industroyer.sexdeplon.blog:2083
industroyer.sexdeplon.blog:2087
industroyer.sexdeplon.blog:2096
industroyer.sexdeplon.blog:8443
rat.sexdeplon.blog:80
rat.sexdeplon.blog:22
rat.sexdeplon.blog:8080
rat.sexdeplon.blog:8880
rat.sexdeplon.blog:2052
rat.sexdeplon.blog:2082
rat.sexdeplon.blog:2086
rat.sexdeplon.blog:2095
rat.sexdeplon.blog:443
rat.sexdeplon.blog:2053
rat.sexdeplon.blog:2083
rat.sexdeplon.blog:2087
rat.sexdeplon.blog:2096
rat.sexdeplon.blog:8443
client.sexdeplon.blog:80
client.sexdeplon.blog:22
client.sexdeplon.blog:8080
client.sexdeplon.blog:8880
client.sexdeplon.blog:2052
client.sexdeplon.blog:2082
client.sexdeplon.blog:2086
client.sexdeplon.blog:2095
client.sexdeplon.blog:443
client.sexdeplon.blog:2053
client.sexdeplon.blog:2083
client.sexdeplon.blog:2087
client.sexdeplon.blog:2096
client.sexdeplon.blog:8443

Mutex

Dm6YgzRNv0SM

Attributes

delay
0
install
true
install_file
mq0zdl.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  cfdd33f38b470cb38bccf6edb5d6d48601368b9358468dbd40c8dd16546a9c3a
- Size 45KB
- SHA256 cfdd33f38b470cb38bccf6edb5d6d48601368b9358468dbd40c8dd16546a9c3a
- MD5 d2ea6e6dc60120dfbfa227869b8a6b98
- SHA1 23ce25726379bf936592b9e6fd60c10927f26bdb
- SHA512 767b1e97842de8b177cfb2be9fb8bca2f7ac178f0d984c80850de213fc987a650a26dc0bc93a7522e2c7a47fb9901cbdde9f0e3115edbc6728d37bb8014bc5f6
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9L583IkOPIdzjb8gr3iXAF7f1GKh6YBDZsx:EulCJTHl42cAF3d3bTrSwF7fAGdsx
- TLSH
  T153231A003BE8812BF2BE4F789DF25145867AF6673603E54E1CC4519B5623BC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2