asyncrat | ac16c162da82cb989909fe8f852248dfeccade118e3fbe8405ddaded1cc7281c

Sharing

Copy URL Twitter E-mail

General

Target
ac16c162da82cb989909fe8f852248dfeccade118e3fbe8405ddaded1cc7281c
Size 45KB
Sample260714-c2964acw5r
SHA256 ac16c162da82cb989909fe8f852248dfeccade118e3fbe8405ddaded1cc7281c
MD5 f6532847a97fe6774466f5e9b33a8a08
SHA1 3b10dfc9e0d6ff921a84bd9cd101ae40ae044198
SHA512 e90045907f233740133f1ecff0a1dacad6698498efa17f6385c91fda7ab4753ca3af7e38143212aa13fe549e06a45bea72a2ca01d9731ea0f8f7ce8d9530ffed
SSDEEP 768:EulCJTHESwgWUK3aGmo2q956R8aI3OPIOzjbWgv3ily/RLtaC5uQEBv9BDZsx:EulCJTHl42m+FO3O3bJvS4vaDLdsx
TLSH
T1C3232B003BE9812BF2BE4F789CF26145827AF6673603D58E1CC4519B5613FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexvtv.net:80
sexvtv.net:22
sexvtv.net:8080
sexvtv.net:8880
sexvtv.net:2052
sexvtv.net:2082
sexvtv.net:2086
sexvtv.net:2095
sexvtv.net:443
sexvtv.net:2053
sexvtv.net:2083
sexvtv.net:2087
sexvtv.net:2096
sexvtv.net:8443
www.sexvtv.net:80
www.sexvtv.net:22
www.sexvtv.net:8080
www.sexvtv.net:8880
www.sexvtv.net:2052
www.sexvtv.net:2082
www.sexvtv.net:2086
www.sexvtv.net:2095
www.sexvtv.net:443
www.sexvtv.net:2053
www.sexvtv.net:2083
www.sexvtv.net:2087
www.sexvtv.net:2096
www.sexvtv.net:8443
zbot.sexvtv.net:80
zbot.sexvtv.net:22
zbot.sexvtv.net:8080
zbot.sexvtv.net:8880
zbot.sexvtv.net:2052
zbot.sexvtv.net:2082
zbot.sexvtv.net:2086
zbot.sexvtv.net:2095
zbot.sexvtv.net:443
zbot.sexvtv.net:2053
zbot.sexvtv.net:2083
zbot.sexvtv.net:2087
zbot.sexvtv.net:2096
zbot.sexvtv.net:8443
connect.sexvtv.net:80
connect.sexvtv.net:22
connect.sexvtv.net:8080
connect.sexvtv.net:8880
connect.sexvtv.net:2052
connect.sexvtv.net:2082
connect.sexvtv.net:2086
connect.sexvtv.net:2095
connect.sexvtv.net:443
connect.sexvtv.net:2053
connect.sexvtv.net:2083
connect.sexvtv.net:2087
connect.sexvtv.net:2096
connect.sexvtv.net:8443
downadup.sexvtv.net:80
downadup.sexvtv.net:22
downadup.sexvtv.net:8080
downadup.sexvtv.net:8880
downadup.sexvtv.net:2052
downadup.sexvtv.net:2082
downadup.sexvtv.net:2086
downadup.sexvtv.net:2095
downadup.sexvtv.net:443
downadup.sexvtv.net:2053
downadup.sexvtv.net:2083
downadup.sexvtv.net:2087
downadup.sexvtv.net:2096
downadup.sexvtv.net:8443
locky.sexvtv.net:80
locky.sexvtv.net:22
locky.sexvtv.net:8080
locky.sexvtv.net:8880
locky.sexvtv.net:2052
locky.sexvtv.net:2082
locky.sexvtv.net:2086
locky.sexvtv.net:2095
locky.sexvtv.net:443
locky.sexvtv.net:2053
locky.sexvtv.net:2083
locky.sexvtv.net:2087
locky.sexvtv.net:2096
locky.sexvtv.net:8443

Mutex

3LuOQarmJwSr

Attributes

delay
0
install
true
install_file
zwhhkj.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  ac16c162da82cb989909fe8f852248dfeccade118e3fbe8405ddaded1cc7281c
- Size 45KB
- SHA256 ac16c162da82cb989909fe8f852248dfeccade118e3fbe8405ddaded1cc7281c
- MD5 f6532847a97fe6774466f5e9b33a8a08
- SHA1 3b10dfc9e0d6ff921a84bd9cd101ae40ae044198
- SHA512 e90045907f233740133f1ecff0a1dacad6698498efa17f6385c91fda7ab4753ca3af7e38143212aa13fe549e06a45bea72a2ca01d9731ea0f8f7ce8d9530ffed
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q956R8aI3OPIOzjbWgv3ily/RLtaC5uQEBv9BDZsx:EulCJTHl42m+FO3O3bJvS4vaDLdsx
- TLSH
  T1C3232B003BE9812BF2BE4F789CF26145827AF6673603D58E1CC4519B5613FC69A42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2