asyncrat | 22c0f79236eea0390459f3b2e73385a43a917a1f55872503466c79ddfbff53e6

Sharing

Copy URL Twitter E-mail

General

Target
22c0f79236eea0390459f3b2e73385a43a917a1f55872503466c79ddfbff53e6
Size 45KB
Sample260714-mpt98adt71
SHA256 22c0f79236eea0390459f3b2e73385a43a917a1f55872503466c79ddfbff53e6
MD5 fc2573c9303074434e2596cad924ae12
SHA1 6cb6c338f180e30e5f53189e6929b8d5c8c3e933
SHA512 6f7ad5cfbfba57e6f69f33d8d7d0774b3a354451482380741b73fa37fee663f6e9d3121dbfe3d7ae9df045e7566abba63ed0fd3ec42a01041753694890164629
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9VxQHJcOPIcUzjbIZgh3i+TFeooalBDZsx:EulCJTHl42esW3cU3bI2hS+T8pardsx
TLSH
T105232B003BE8C12BF2BE4F7899F26145867AF2673603E58E1CC4519B5613FC6DA426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cdn.cd-vs.com:80
cdn.cd-vs.com:22
cdn.cd-vs.com:8080
cdn.cd-vs.com:8880
cdn.cd-vs.com:2052
cdn.cd-vs.com:2082
cdn.cd-vs.com:2086
cdn.cd-vs.com:2095
cdn.cd-vs.com:443
cdn.cd-vs.com:2053
cdn.cd-vs.com:2083
cdn.cd-vs.com:2087
cdn.cd-vs.com:2096
cdn.cd-vs.com:8443
www.cdn.cd-vs.com:80
www.cdn.cd-vs.com:22
www.cdn.cd-vs.com:8080
www.cdn.cd-vs.com:8880
www.cdn.cd-vs.com:2052
www.cdn.cd-vs.com:2082
www.cdn.cd-vs.com:2086
www.cdn.cd-vs.com:2095
www.cdn.cd-vs.com:443
www.cdn.cd-vs.com:2053
www.cdn.cd-vs.com:2083
www.cdn.cd-vs.com:2087
www.cdn.cd-vs.com:2096
www.cdn.cd-vs.com:8443
downadup.cdn.cd-vs.com:80
downadup.cdn.cd-vs.com:22
downadup.cdn.cd-vs.com:8080
downadup.cdn.cd-vs.com:8880
downadup.cdn.cd-vs.com:2052
downadup.cdn.cd-vs.com:2082
downadup.cdn.cd-vs.com:2086
downadup.cdn.cd-vs.com:2095
downadup.cdn.cd-vs.com:443
downadup.cdn.cd-vs.com:2053
downadup.cdn.cd-vs.com:2083
downadup.cdn.cd-vs.com:2087
downadup.cdn.cd-vs.com:2096
downadup.cdn.cd-vs.com:8443
remote.cdn.cd-vs.com:80
remote.cdn.cd-vs.com:22
remote.cdn.cd-vs.com:8080
remote.cdn.cd-vs.com:8880
remote.cdn.cd-vs.com:2052
remote.cdn.cd-vs.com:2082
remote.cdn.cd-vs.com:2086
remote.cdn.cd-vs.com:2095
remote.cdn.cd-vs.com:443
remote.cdn.cd-vs.com:2053
remote.cdn.cd-vs.com:2083
remote.cdn.cd-vs.com:2087
remote.cdn.cd-vs.com:2096
remote.cdn.cd-vs.com:8443
agenttesla.cdn.cd-vs.com:80
agenttesla.cdn.cd-vs.com:22
agenttesla.cdn.cd-vs.com:8080
agenttesla.cdn.cd-vs.com:8880
agenttesla.cdn.cd-vs.com:2052
agenttesla.cdn.cd-vs.com:2082
agenttesla.cdn.cd-vs.com:2086
agenttesla.cdn.cd-vs.com:2095
agenttesla.cdn.cd-vs.com:443
agenttesla.cdn.cd-vs.com:2053
agenttesla.cdn.cd-vs.com:2083
agenttesla.cdn.cd-vs.com:2087
agenttesla.cdn.cd-vs.com:2096
agenttesla.cdn.cd-vs.com:8443

Mutex

PJc2TcyOp9iJ

Attributes

delay
0
install
true
install_file
fvd6bn.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  22c0f79236eea0390459f3b2e73385a43a917a1f55872503466c79ddfbff53e6
- Size 45KB
- SHA256 22c0f79236eea0390459f3b2e73385a43a917a1f55872503466c79ddfbff53e6
- MD5 fc2573c9303074434e2596cad924ae12
- SHA1 6cb6c338f180e30e5f53189e6929b8d5c8c3e933
- SHA512 6f7ad5cfbfba57e6f69f33d8d7d0774b3a354451482380741b73fa37fee663f6e9d3121dbfe3d7ae9df045e7566abba63ed0fd3ec42a01041753694890164629
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9VxQHJcOPIcUzjbIZgh3i+TFeooalBDZsx:EulCJTHl42esW3cU3bI2hS+T8pardsx
- TLSH
  T105232B003BE8C12BF2BE4F7899F26145867AF2673603E58E1CC4519B5613FC6DA426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2