asyncrat | 520c0376e23932ed0accfdc6ce5b8c035fd5236cbfd4a91f46577263e19d72fb

Sharing

Copy URL Twitter E-mail

General

Target
520c0376e23932ed0accfdc6ce5b8c035fd5236cbfd4a91f46577263e19d72fb
Size 45KB
Sample260714-c43vsscw7j
SHA256 520c0376e23932ed0accfdc6ce5b8c035fd5236cbfd4a91f46577263e19d72fb
MD5 6318f80d112a8209825da672470c5768
SHA1 b7b07d275d2c3f58fc8715ce5721a51288ffecd0
SHA512 fde449c08988c475174e982374c86b2016ab32b2a4c0110dd62946ee5d98c34c5e37a4203e4b0793583e31c91d41b4d0d85836eda5ec5fce410e22e81c3b13e7
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1n+GtCVnJtHuPI+zjbkgX3iWOqb4eN2UaQ6iMbB0:cu6YepTPso2M+TB3+3brXShGGlwMNdUx
TLSH
T171231B0037E8812BF2BE4FB898F26145867AF6637603D54D2CC452DB5623FC6DA426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

haysex.vip:80
haysex.vip:22
haysex.vip:8080
haysex.vip:8880
haysex.vip:2052
haysex.vip:2082
haysex.vip:2086
haysex.vip:2095
haysex.vip:443
haysex.vip:2053
haysex.vip:2083
haysex.vip:2087
haysex.vip:2096
haysex.vip:8443
www.haysex.vip:80
www.haysex.vip:22
www.haysex.vip:8080
www.haysex.vip:8880
www.haysex.vip:2052
www.haysex.vip:2082
www.haysex.vip:2086
www.haysex.vip:2095
www.haysex.vip:443
www.haysex.vip:2053
www.haysex.vip:2083
www.haysex.vip:2087
www.haysex.vip:2096
www.haysex.vip:8443
industroyer.haysex.vip:80
industroyer.haysex.vip:22
industroyer.haysex.vip:8080
industroyer.haysex.vip:8880
industroyer.haysex.vip:2052
industroyer.haysex.vip:2082
industroyer.haysex.vip:2086
industroyer.haysex.vip:2095
industroyer.haysex.vip:443
industroyer.haysex.vip:2053
industroyer.haysex.vip:2083
industroyer.haysex.vip:2087
industroyer.haysex.vip:2096
industroyer.haysex.vip:8443
sodinokibi.haysex.vip:80
sodinokibi.haysex.vip:22
sodinokibi.haysex.vip:8080
sodinokibi.haysex.vip:8880
sodinokibi.haysex.vip:2052
sodinokibi.haysex.vip:2082
sodinokibi.haysex.vip:2086
sodinokibi.haysex.vip:2095
sodinokibi.haysex.vip:443
sodinokibi.haysex.vip:2053
sodinokibi.haysex.vip:2083
sodinokibi.haysex.vip:2087
sodinokibi.haysex.vip:2096
sodinokibi.haysex.vip:8443
zeus.haysex.vip:80
zeus.haysex.vip:22
zeus.haysex.vip:8080
zeus.haysex.vip:8880
zeus.haysex.vip:2052
zeus.haysex.vip:2082
zeus.haysex.vip:2086
zeus.haysex.vip:2095
zeus.haysex.vip:443
zeus.haysex.vip:2053
zeus.haysex.vip:2083
zeus.haysex.vip:2087
zeus.haysex.vip:2096
zeus.haysex.vip:8443
invasive.haysex.vip:80
invasive.haysex.vip:22
invasive.haysex.vip:8080
invasive.haysex.vip:8880
invasive.haysex.vip:2052
invasive.haysex.vip:2082
invasive.haysex.vip:2086
invasive.haysex.vip:2095
invasive.haysex.vip:443
invasive.haysex.vip:2053
invasive.haysex.vip:2083
invasive.haysex.vip:2087
invasive.haysex.vip:2096
invasive.haysex.vip:8443

Mutex

M24ZH7kch62R

Attributes

delay
0
install
true
install_file
wu021zhf.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  520c0376e23932ed0accfdc6ce5b8c035fd5236cbfd4a91f46577263e19d72fb
- Size 45KB
- SHA256 520c0376e23932ed0accfdc6ce5b8c035fd5236cbfd4a91f46577263e19d72fb
- MD5 6318f80d112a8209825da672470c5768
- SHA1 b7b07d275d2c3f58fc8715ce5721a51288ffecd0
- SHA512 fde449c08988c475174e982374c86b2016ab32b2a4c0110dd62946ee5d98c34c5e37a4203e4b0793583e31c91d41b4d0d85836eda5ec5fce410e22e81c3b13e7
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1n+GtCVnJtHuPI+zjbkgX3iWOqb4eN2UaQ6iMbB0:cu6YepTPso2M+TB3+3brXShGGlwMNdUx
- TLSH
  T171231B0037E8812BF2BE4FB898F26145867AF6637603D54D2CC452DB5623FC6DA426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2