asyncrat | bcc2a9d359b184abe55f464031cab096c8844bd5e97bf7533e0972bd4e2fc4df

Sharing

Copy URL Twitter E-mail

General

Target
bcc2a9d359b184abe55f464031cab096c8844bd5e97bf7533e0972bd4e2fc4df
Size 45KB
Sample260716-ghctpsd14n
SHA256 bcc2a9d359b184abe55f464031cab096c8844bd5e97bf7533e0972bd4e2fc4df
MD5 2e869681de997505ffbe0afb275e7c34
SHA1 88874683d617dd6caf630c93b3001252aff31e6b
SHA512 7f442c623ce2b1312dac134d211054873638de7aa109b97fb6ba7f0a4aa8ef1afbddab40886a2a18383638c7db3f769fd6c102ce742c32e8abba97c6c23b3970
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMjPIugjbjgX3igA0Px4IfxDbDGmBDZ0x:8uuSpTgyf2dg1uIb8XS2Px4IpDGod0x
TLSH
T1FA232B0037E8C12BF2BE5F78A9F26145867AF2673A03D54D1CC451DB1B23BC69642AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vuasexviet.com:80
vuasexviet.com:22
vuasexviet.com:8080
vuasexviet.com:8880
vuasexviet.com:2052
vuasexviet.com:2082
vuasexviet.com:2086
vuasexviet.com:2095
vuasexviet.com:443
vuasexviet.com:2053
vuasexviet.com:2083
vuasexviet.com:2087
vuasexviet.com:2096
vuasexviet.com:8443
www.vuasexviet.com:80
www.vuasexviet.com:22
www.vuasexviet.com:8080
www.vuasexviet.com:8880
www.vuasexviet.com:2052
www.vuasexviet.com:2082
www.vuasexviet.com:2086
www.vuasexviet.com:2095
www.vuasexviet.com:443
www.vuasexviet.com:2053
www.vuasexviet.com:2083
www.vuasexviet.com:2087
www.vuasexviet.com:2096
www.vuasexviet.com:8443
sodinokibi.vuasexviet.com:80
sodinokibi.vuasexviet.com:22
sodinokibi.vuasexviet.com:8080
sodinokibi.vuasexviet.com:8880
sodinokibi.vuasexviet.com:2052
sodinokibi.vuasexviet.com:2082
sodinokibi.vuasexviet.com:2086
sodinokibi.vuasexviet.com:2095
sodinokibi.vuasexviet.com:443
sodinokibi.vuasexviet.com:2053
sodinokibi.vuasexviet.com:2083
sodinokibi.vuasexviet.com:2087
sodinokibi.vuasexviet.com:2096
sodinokibi.vuasexviet.com:8443
ursnif.vuasexviet.com:80
ursnif.vuasexviet.com:22
ursnif.vuasexviet.com:8080
ursnif.vuasexviet.com:8880
ursnif.vuasexviet.com:2052
ursnif.vuasexviet.com:2082
ursnif.vuasexviet.com:2086
ursnif.vuasexviet.com:2095
ursnif.vuasexviet.com:443
ursnif.vuasexviet.com:2053
ursnif.vuasexviet.com:2083
ursnif.vuasexviet.com:2087
ursnif.vuasexviet.com:2096
ursnif.vuasexviet.com:8443
remote.vuasexviet.com:80
remote.vuasexviet.com:22
remote.vuasexviet.com:8080
remote.vuasexviet.com:8880
remote.vuasexviet.com:2052
remote.vuasexviet.com:2082
remote.vuasexviet.com:2086
remote.vuasexviet.com:2095
remote.vuasexviet.com:443
remote.vuasexviet.com:2053
remote.vuasexviet.com:2083
remote.vuasexviet.com:2087
remote.vuasexviet.com:2096
remote.vuasexviet.com:8443
gozi.vuasexviet.com:80
gozi.vuasexviet.com:22
gozi.vuasexviet.com:8080
gozi.vuasexviet.com:8880
gozi.vuasexviet.com:2052
gozi.vuasexviet.com:2082
gozi.vuasexviet.com:2086
gozi.vuasexviet.com:2095
gozi.vuasexviet.com:443
gozi.vuasexviet.com:2053
gozi.vuasexviet.com:2083
gozi.vuasexviet.com:2087
gozi.vuasexviet.com:2096
gozi.vuasexviet.com:8443

Mutex

0i8NmCAdAZYb

Attributes

delay
0
install
true
install_file
ohs9o7.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  bcc2a9d359b184abe55f464031cab096c8844bd5e97bf7533e0972bd4e2fc4df
- Size 45KB
- SHA256 bcc2a9d359b184abe55f464031cab096c8844bd5e97bf7533e0972bd4e2fc4df
- MD5 2e869681de997505ffbe0afb275e7c34
- SHA1 88874683d617dd6caf630c93b3001252aff31e6b
- SHA512 7f442c623ce2b1312dac134d211054873638de7aa109b97fb6ba7f0a4aa8ef1afbddab40886a2a18383638c7db3f769fd6c102ce742c32e8abba97c6c23b3970
- SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMjPIugjbjgX3igA0Px4IfxDbDGmBDZ0x:8uuSpTgyf2dg1uIb8XS2Px4IpDGod0x
- TLSH
  T1FA232B0037E8C12BF2BE5F78A9F26145867AF2673A03D54D1CC451DB1B23BC69642AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2