asyncrat | 3c544776c9ee62192bb106c3ac40d9f74fe78df6d1ac65d73e17c0d34cb0f291

Sharing

Copy URL Twitter E-mail

General

Target
3c544776c9ee62192bb106c3ac40d9f74fe78df6d1ac65d73e17c0d34cb0f291
Size 45KB
Sample260715-rntphset9m
SHA256 3c544776c9ee62192bb106c3ac40d9f74fe78df6d1ac65d73e17c0d34cb0f291
MD5 47a73f9e979e175f6e4b2856ddcf56b5
SHA1 29d716552795e42d38375b436283d5333dc0e1e0
SHA512 65840d08f8b2464ce1149c3c942e7445d4f86d55b578101208485340e691d4b68cf8f6693ce681616ad92fe45116631764d2263b6544bf38e445cf3e0869711c
SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMITnyfaaPIRzjbMgX3iF6i0E34xJXATBDZ8x:0u2vpTDe+2FEhR3bDXSktE3wXGd8x
TLSH
T11B232B003BE9C12BF2BF5F789DF26145867AF6632603D5891CC411DB5613FC68A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vuasexviet.com:80
vuasexviet.com:22
vuasexviet.com:8080
vuasexviet.com:8880
vuasexviet.com:2052
vuasexviet.com:2082
vuasexviet.com:2086
vuasexviet.com:2095
vuasexviet.com:443
vuasexviet.com:2053
vuasexviet.com:2083
vuasexviet.com:2087
vuasexviet.com:2096
vuasexviet.com:8443
www.vuasexviet.com:80
www.vuasexviet.com:22
www.vuasexviet.com:8080
www.vuasexviet.com:8880
www.vuasexviet.com:2052
www.vuasexviet.com:2082
www.vuasexviet.com:2086
www.vuasexviet.com:2095
www.vuasexviet.com:443
www.vuasexviet.com:2053
www.vuasexviet.com:2083
www.vuasexviet.com:2087
www.vuasexviet.com:2096
www.vuasexviet.com:8443
sasser.vuasexviet.com:80
sasser.vuasexviet.com:22
sasser.vuasexviet.com:8080
sasser.vuasexviet.com:8880
sasser.vuasexviet.com:2052
sasser.vuasexviet.com:2082
sasser.vuasexviet.com:2086
sasser.vuasexviet.com:2095
sasser.vuasexviet.com:443
sasser.vuasexviet.com:2053
sasser.vuasexviet.com:2083
sasser.vuasexviet.com:2087
sasser.vuasexviet.com:2096
sasser.vuasexviet.com:8443
stuxnet.vuasexviet.com:80
stuxnet.vuasexviet.com:22
stuxnet.vuasexviet.com:8080
stuxnet.vuasexviet.com:8880
stuxnet.vuasexviet.com:2052
stuxnet.vuasexviet.com:2082
stuxnet.vuasexviet.com:2086
stuxnet.vuasexviet.com:2095
stuxnet.vuasexviet.com:443
stuxnet.vuasexviet.com:2053
stuxnet.vuasexviet.com:2083
stuxnet.vuasexviet.com:2087
stuxnet.vuasexviet.com:2096
stuxnet.vuasexviet.com:8443
fakeupdates.vuasexviet.com:80
fakeupdates.vuasexviet.com:22
fakeupdates.vuasexviet.com:8080
fakeupdates.vuasexviet.com:8880
fakeupdates.vuasexviet.com:2052
fakeupdates.vuasexviet.com:2082
fakeupdates.vuasexviet.com:2086
fakeupdates.vuasexviet.com:2095
fakeupdates.vuasexviet.com:443
fakeupdates.vuasexviet.com:2053
fakeupdates.vuasexviet.com:2083
fakeupdates.vuasexviet.com:2087
fakeupdates.vuasexviet.com:2096
fakeupdates.vuasexviet.com:8443
formbook.vuasexviet.com:80
formbook.vuasexviet.com:22
formbook.vuasexviet.com:8080
formbook.vuasexviet.com:8880
formbook.vuasexviet.com:2052
formbook.vuasexviet.com:2082
formbook.vuasexviet.com:2086
formbook.vuasexviet.com:2095
formbook.vuasexviet.com:443
formbook.vuasexviet.com:2053
formbook.vuasexviet.com:2083
formbook.vuasexviet.com:2087
formbook.vuasexviet.com:2096
formbook.vuasexviet.com:8443

Mutex

mgtLA6h4mkv4

Attributes

delay
0
install
true
install_file
0kclfm3.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  3c544776c9ee62192bb106c3ac40d9f74fe78df6d1ac65d73e17c0d34cb0f291
- Size 45KB
- SHA256 3c544776c9ee62192bb106c3ac40d9f74fe78df6d1ac65d73e17c0d34cb0f291
- MD5 47a73f9e979e175f6e4b2856ddcf56b5
- SHA1 29d716552795e42d38375b436283d5333dc0e1e0
- SHA512 65840d08f8b2464ce1149c3c942e7445d4f86d55b578101208485340e691d4b68cf8f6693ce681616ad92fe45116631764d2263b6544bf38e445cf3e0869711c
- SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMITnyfaaPIRzjbMgX3iF6i0E34xJXATBDZ8x:0u2vpTDe+2FEhR3bDXSktE3wXGd8x
- TLSH
  T11B232B003BE9C12BF2BF5F789DF26145867AF6632603D5891CC411DB5613FC68A42AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2