asyncrat | 5e676eb79fffa844ee8a9ee045d421c8ff2eafbed5f6dfbf11af7b2038e271a1

Sharing

Copy URL Twitter E-mail

General

Target
5e676eb79fffa844ee8a9ee045d421c8ff2eafbed5f6dfbf11af7b2038e271a1
Size 45KB
Sample260714-j5238ahs5k
SHA256 5e676eb79fffa844ee8a9ee045d421c8ff2eafbed5f6dfbf11af7b2038e271a1
MD5 6db4272d521b72bb625dea22804a5295
SHA1 dc77a61863ecac759697a61ee8770c2d8ba21336
SHA512 f593628b38a74cc68834aeb07608796686ab2b5a50a1195006c066162bc935009ae93f8a9cda5794b6c47b98c3f1494ca14474737941e734c9e31d4ae10a7baa
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYW9+N6KbtOPIMtzjbsgX3MSy/lZcNM5PLBDZ0x:8uuSpTgyf2ekDZ3Mt3bjXcRLP5Pdd0x
TLSH
T17D232B003BE8C12BF2BE4F789DF26145867AF6633603D64E1CC4519B5613FC69A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cdn.cd-vs.com:80
cdn.cd-vs.com:22
cdn.cd-vs.com:8080
cdn.cd-vs.com:8880
cdn.cd-vs.com:2052
cdn.cd-vs.com:2082
cdn.cd-vs.com:2086
cdn.cd-vs.com:2095
cdn.cd-vs.com:443
cdn.cd-vs.com:2053
cdn.cd-vs.com:2083
cdn.cd-vs.com:2087
cdn.cd-vs.com:2096
cdn.cd-vs.com:8443
www.cdn.cd-vs.com:80
www.cdn.cd-vs.com:22
www.cdn.cd-vs.com:8080
www.cdn.cd-vs.com:8880
www.cdn.cd-vs.com:2052
www.cdn.cd-vs.com:2082
www.cdn.cd-vs.com:2086
www.cdn.cd-vs.com:2095
www.cdn.cd-vs.com:443
www.cdn.cd-vs.com:2053
www.cdn.cd-vs.com:2083
www.cdn.cd-vs.com:2087
www.cdn.cd-vs.com:2096
www.cdn.cd-vs.com:8443
conti.cdn.cd-vs.com:80
conti.cdn.cd-vs.com:22
conti.cdn.cd-vs.com:8080
conti.cdn.cd-vs.com:8880
conti.cdn.cd-vs.com:2052
conti.cdn.cd-vs.com:2082
conti.cdn.cd-vs.com:2086
conti.cdn.cd-vs.com:2095
conti.cdn.cd-vs.com:443
conti.cdn.cd-vs.com:2053
conti.cdn.cd-vs.com:2083
conti.cdn.cd-vs.com:2087
conti.cdn.cd-vs.com:2096
conti.cdn.cd-vs.com:8443
blacklotus.cdn.cd-vs.com:80
blacklotus.cdn.cd-vs.com:22
blacklotus.cdn.cd-vs.com:8080
blacklotus.cdn.cd-vs.com:8880
blacklotus.cdn.cd-vs.com:2052
blacklotus.cdn.cd-vs.com:2082
blacklotus.cdn.cd-vs.com:2086
blacklotus.cdn.cd-vs.com:2095
blacklotus.cdn.cd-vs.com:443
blacklotus.cdn.cd-vs.com:2053
blacklotus.cdn.cd-vs.com:2083
blacklotus.cdn.cd-vs.com:2087
blacklotus.cdn.cd-vs.com:2096
blacklotus.cdn.cd-vs.com:8443
connect.cdn.cd-vs.com:80
connect.cdn.cd-vs.com:22
connect.cdn.cd-vs.com:8080
connect.cdn.cd-vs.com:8880
connect.cdn.cd-vs.com:2052
connect.cdn.cd-vs.com:2082
connect.cdn.cd-vs.com:2086
connect.cdn.cd-vs.com:2095
connect.cdn.cd-vs.com:443
connect.cdn.cd-vs.com:2053
connect.cdn.cd-vs.com:2083
connect.cdn.cd-vs.com:2087
connect.cdn.cd-vs.com:2096
connect.cdn.cd-vs.com:8443
qbot.cdn.cd-vs.com:80
qbot.cdn.cd-vs.com:22
qbot.cdn.cd-vs.com:8080
qbot.cdn.cd-vs.com:8880
qbot.cdn.cd-vs.com:2052
qbot.cdn.cd-vs.com:2082
qbot.cdn.cd-vs.com:2086
qbot.cdn.cd-vs.com:2095
qbot.cdn.cd-vs.com:443
qbot.cdn.cd-vs.com:2053
qbot.cdn.cd-vs.com:2083
qbot.cdn.cd-vs.com:2087
qbot.cdn.cd-vs.com:2096
qbot.cdn.cd-vs.com:8443

Mutex

NFVUZKzZPwnP

Attributes

delay
0
install
true
install_file
krsuhs.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5e676eb79fffa844ee8a9ee045d421c8ff2eafbed5f6dfbf11af7b2038e271a1
- Size 45KB
- SHA256 5e676eb79fffa844ee8a9ee045d421c8ff2eafbed5f6dfbf11af7b2038e271a1
- MD5 6db4272d521b72bb625dea22804a5295
- SHA1 dc77a61863ecac759697a61ee8770c2d8ba21336
- SHA512 f593628b38a74cc68834aeb07608796686ab2b5a50a1195006c066162bc935009ae93f8a9cda5794b6c47b98c3f1494ca14474737941e734c9e31d4ae10a7baa
- SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYW9+N6KbtOPIMtzjbsgX3MSy/lZcNM5PLBDZ0x:8uuSpTgyf2ekDZ3Mt3bjXcRLP5Pdd0x
- TLSH
  T17D232B003BE8C12BF2BE4F789DF26145867AF6633603D64E1CC4519B5613FC69A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2