asyncrat | 49e519959de00a1401c118faeb4e99dacb7724f93bff80e263151241aad1be68

Sharing

Copy URL Twitter E-mail

General

Target
49e519959de00a1401c118faeb4e99dacb7724f93bff80e263151241aad1be68
Size 45KB
Sample260714-phb66sev5s
SHA256 49e519959de00a1401c118faeb4e99dacb7724f93bff80e263151241aad1be68
MD5 f524cd2f0c4c3a7dbd031e76a123efc1
SHA1 1bc8824e442cd72b040f61cf39e6fd09b9b6a150
SHA512 0e9e714190c9b499904aef092baaf07ab8c15b073a878c6e313d76f3b73291b5990fbc06c26fa1d54088320c0a3cffb9b4af18a7c0106cf6c89b43174ed169dd
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFB3XoPEayPIwzjbmgX3i8/KdXJFfjwXCH74BDZEx:MuLAZTnbg2umEabw3b5XSxx77wXyqdEx
TLSH
T1D8231B003BE8822BF2BE4F78A9F26145867AF6736603D5492CC411D75713FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexviet11.com:80
sexviet11.com:22
sexviet11.com:8080
sexviet11.com:8880
sexviet11.com:2052
sexviet11.com:2082
sexviet11.com:2086
sexviet11.com:2095
sexviet11.com:443
sexviet11.com:2053
sexviet11.com:2083
sexviet11.com:2087
sexviet11.com:2096
sexviet11.com:8443
www.sexviet11.com:80
www.sexviet11.com:22
www.sexviet11.com:8080
www.sexviet11.com:8880
www.sexviet11.com:2052
www.sexviet11.com:2082
www.sexviet11.com:2086
www.sexviet11.com:2095
www.sexviet11.com:443
www.sexviet11.com:2053
www.sexviet11.com:2083
www.sexviet11.com:2087
www.sexviet11.com:2096
www.sexviet11.com:8443
mirai.sexviet11.com:80
mirai.sexviet11.com:22
mirai.sexviet11.com:8080
mirai.sexviet11.com:8880
mirai.sexviet11.com:2052
mirai.sexviet11.com:2082
mirai.sexviet11.com:2086
mirai.sexviet11.com:2095
mirai.sexviet11.com:443
mirai.sexviet11.com:2053
mirai.sexviet11.com:2083
mirai.sexviet11.com:2087
mirai.sexviet11.com:2096
mirai.sexviet11.com:8443
agenttesla.sexviet11.com:80
agenttesla.sexviet11.com:22
agenttesla.sexviet11.com:8080
agenttesla.sexviet11.com:8880
agenttesla.sexviet11.com:2052
agenttesla.sexviet11.com:2082
agenttesla.sexviet11.com:2086
agenttesla.sexviet11.com:2095
agenttesla.sexviet11.com:443
agenttesla.sexviet11.com:2053
agenttesla.sexviet11.com:2083
agenttesla.sexviet11.com:2087
agenttesla.sexviet11.com:2096
agenttesla.sexviet11.com:8443
invasive.sexviet11.com:80
invasive.sexviet11.com:22
invasive.sexviet11.com:8080
invasive.sexviet11.com:8880
invasive.sexviet11.com:2052
invasive.sexviet11.com:2082
invasive.sexviet11.com:2086
invasive.sexviet11.com:2095
invasive.sexviet11.com:443
invasive.sexviet11.com:2053
invasive.sexviet11.com:2083
invasive.sexviet11.com:2087
invasive.sexviet11.com:2096
invasive.sexviet11.com:8443

Mutex

DmQGyOTZEPGv

Attributes

delay
0
install
true
install_file
9duu1.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  49e519959de00a1401c118faeb4e99dacb7724f93bff80e263151241aad1be68
- Size 45KB
- SHA256 49e519959de00a1401c118faeb4e99dacb7724f93bff80e263151241aad1be68
- MD5 f524cd2f0c4c3a7dbd031e76a123efc1
- SHA1 1bc8824e442cd72b040f61cf39e6fd09b9b6a150
- SHA512 0e9e714190c9b499904aef092baaf07ab8c15b073a878c6e313d76f3b73291b5990fbc06c26fa1d54088320c0a3cffb9b4af18a7c0106cf6c89b43174ed169dd
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFB3XoPEayPIwzjbmgX3i8/KdXJFfjwXCH74BDZEx:MuLAZTnbg2umEabw3b5XSxx77wXyqdEx
- TLSH
  T1D8231B003BE8822BF2BE4F78A9F26145867AF6736603D5492CC411D75713FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2