asyncrat | 54f4a4446cfe6901e66d925771b1917317e08cda4504bc7b5172859b83ece51b

Sharing

Copy URL Twitter E-mail

General

Target
54f4a4446cfe6901e66d925771b1917317e08cda4504bc7b5172859b83ece51b
Size 45KB
Sample260714-mee3jsay2q
SHA256 54f4a4446cfe6901e66d925771b1917317e08cda4504bc7b5172859b83ece51b
MD5 1c874484b16ccee6e7699360b501ed69
SHA1 ba1b0c83f7ff690c998cf138e1fe98995c62647e
SHA512 0d8c3020fc3948ce6a94f38c132f2f533858813aa1e7a2d8be058cb78c246c7d43973c3256687fb671a45a5218b9da0e1a30e805bac5111cf7b4699e57d22e7a
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1mb30GYjHuPI8zjbGgXhiuz4lTRfgdpzc36BDZUx:cu6YepTPso2jw/383bZXwW4/fyg3kdUx
TLSH
T183231A0037E8812AF2BE4FB4A9F26145467AF2637603D68D1CC451DB5623FC6DA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexvietfree.com:80
sexvietfree.com:22
sexvietfree.com:8080
sexvietfree.com:8880
sexvietfree.com:2052
sexvietfree.com:2082
sexvietfree.com:2086
sexvietfree.com:2095
sexvietfree.com:443
sexvietfree.com:2053
sexvietfree.com:2083
sexvietfree.com:2087
sexvietfree.com:2096
sexvietfree.com:8443
www.sexvietfree.com:80
www.sexvietfree.com:22
www.sexvietfree.com:8080
www.sexvietfree.com:8880
www.sexvietfree.com:2052
www.sexvietfree.com:2082
www.sexvietfree.com:2086
www.sexvietfree.com:2095
www.sexvietfree.com:443
www.sexvietfree.com:2053
www.sexvietfree.com:2083
www.sexvietfree.com:2087
www.sexvietfree.com:2096
www.sexvietfree.com:8443
notpetya.sexvietfree.com:80
notpetya.sexvietfree.com:22
notpetya.sexvietfree.com:8080
notpetya.sexvietfree.com:8880
notpetya.sexvietfree.com:2052
notpetya.sexvietfree.com:2082
notpetya.sexvietfree.com:2086
notpetya.sexvietfree.com:2095
notpetya.sexvietfree.com:443
notpetya.sexvietfree.com:2053
notpetya.sexvietfree.com:2083
notpetya.sexvietfree.com:2087
notpetya.sexvietfree.com:2096
notpetya.sexvietfree.com:8443
invasive.sexvietfree.com:80
invasive.sexvietfree.com:22
invasive.sexvietfree.com:8080
invasive.sexvietfree.com:8880
invasive.sexvietfree.com:2052
invasive.sexvietfree.com:2082
invasive.sexvietfree.com:2086
invasive.sexvietfree.com:2095
invasive.sexvietfree.com:443
invasive.sexvietfree.com:2053
invasive.sexvietfree.com:2083
invasive.sexvietfree.com:2087
invasive.sexvietfree.com:2096
invasive.sexvietfree.com:8443
conti.sexvietfree.com:80
conti.sexvietfree.com:22
conti.sexvietfree.com:8080
conti.sexvietfree.com:8880
conti.sexvietfree.com:2052
conti.sexvietfree.com:2082
conti.sexvietfree.com:2086
conti.sexvietfree.com:2095
conti.sexvietfree.com:443
conti.sexvietfree.com:2053
conti.sexvietfree.com:2083
conti.sexvietfree.com:2087
conti.sexvietfree.com:2096
conti.sexvietfree.com:8443

Mutex

aKmPNaZxAz5V

Attributes

delay
0
install
true
install_file
xn26k60o.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  54f4a4446cfe6901e66d925771b1917317e08cda4504bc7b5172859b83ece51b
- Size 45KB
- SHA256 54f4a4446cfe6901e66d925771b1917317e08cda4504bc7b5172859b83ece51b
- MD5 1c874484b16ccee6e7699360b501ed69
- SHA1 ba1b0c83f7ff690c998cf138e1fe98995c62647e
- SHA512 0d8c3020fc3948ce6a94f38c132f2f533858813aa1e7a2d8be058cb78c246c7d43973c3256687fb671a45a5218b9da0e1a30e805bac5111cf7b4699e57d22e7a
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1mb30GYjHuPI8zjbGgXhiuz4lTRfgdpzc36BDZUx:cu6YepTPso2jw/383bZXwW4/fyg3kdUx
- TLSH
  T183231A0037E8812AF2BE4FB4A9F26145467AF2637603D68D1CC451DB5623FC6DA426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2