asyncrat | 4c0900f9e02b61d823acf8700f9b1be5b95b1ad375307fa60138cdcbe4304608

Sharing

Copy URL Twitter E-mail

General

Target
4c0900f9e02b61d823acf8700f9b1be5b95b1ad375307fa60138cdcbe4304608
Size 45KB
Sample260716-le2e4shv7m
SHA256 4c0900f9e02b61d823acf8700f9b1be5b95b1ad375307fa60138cdcbe4304608
MD5 88a2a09b6046ed3ed16b69b2d44f3916
SHA1 1dd66f822bfec0c50070b34b8c9f0e873238fd62
SHA512 d9a3a66fdf0cc85932bcb01212106718212bb34f26bac7784817b164139da29f8e67352b0e466243c4ec407319ffd57243419cef3bbed24ac33dd526c574d39b
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q97Iz/yPqiPI+zjbsgX3ij54QSbOgrQgcH6Z7qBDZ8x:0uPrpT/qY24c5+3bjXSl4f5rQbaZQd8x
TLSH
T1F8232A0037E9C12BF2BE4B7899F26145867AF6632A03D58E1CC411DB5713FC69B426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexvuto.site:80
sexvuto.site:22
sexvuto.site:8080
sexvuto.site:8880
sexvuto.site:2052
sexvuto.site:2082
sexvuto.site:2086
sexvuto.site:2095
sexvuto.site:443
sexvuto.site:2053
sexvuto.site:2083
sexvuto.site:2087
sexvuto.site:2096
sexvuto.site:8443
www.sexvuto.site:80
www.sexvuto.site:22
www.sexvuto.site:8080
www.sexvuto.site:8880
www.sexvuto.site:2052
www.sexvuto.site:2082
www.sexvuto.site:2086
www.sexvuto.site:2095
www.sexvuto.site:443
www.sexvuto.site:2053
www.sexvuto.site:2083
www.sexvuto.site:2087
www.sexvuto.site:2096
www.sexvuto.site:8443
locky.sexvuto.site:80
locky.sexvuto.site:22
locky.sexvuto.site:8080
locky.sexvuto.site:8880
locky.sexvuto.site:2052
locky.sexvuto.site:2082
locky.sexvuto.site:2086
locky.sexvuto.site:2095
locky.sexvuto.site:443
locky.sexvuto.site:2053
locky.sexvuto.site:2083
locky.sexvuto.site:2087
locky.sexvuto.site:2096
locky.sexvuto.site:8443
triton.sexvuto.site:80
triton.sexvuto.site:22
triton.sexvuto.site:8080
triton.sexvuto.site:8880
triton.sexvuto.site:2052
triton.sexvuto.site:2082
triton.sexvuto.site:2086
triton.sexvuto.site:2095
triton.sexvuto.site:443
triton.sexvuto.site:2053
triton.sexvuto.site:2083
triton.sexvuto.site:2087
triton.sexvuto.site:2096
triton.sexvuto.site:8443
dridex.sexvuto.site:80
dridex.sexvuto.site:22
dridex.sexvuto.site:8080
dridex.sexvuto.site:8880
dridex.sexvuto.site:2052
dridex.sexvuto.site:2082
dridex.sexvuto.site:2086
dridex.sexvuto.site:2095
dridex.sexvuto.site:443
dridex.sexvuto.site:2053
dridex.sexvuto.site:2083
dridex.sexvuto.site:2087
dridex.sexvuto.site:2096
dridex.sexvuto.site:8443

Mutex

aFlslgAFiBQA

Attributes

delay
0
install
true
install_file
w4an4o1.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4c0900f9e02b61d823acf8700f9b1be5b95b1ad375307fa60138cdcbe4304608
- Size 45KB
- SHA256 4c0900f9e02b61d823acf8700f9b1be5b95b1ad375307fa60138cdcbe4304608
- MD5 88a2a09b6046ed3ed16b69b2d44f3916
- SHA1 1dd66f822bfec0c50070b34b8c9f0e873238fd62
- SHA512 d9a3a66fdf0cc85932bcb01212106718212bb34f26bac7784817b164139da29f8e67352b0e466243c4ec407319ffd57243419cef3bbed24ac33dd526c574d39b
- SSDEEP 768:0uPrpT/LGKeWUszuAmo2q97Iz/yPqiPI+zjbsgX3ij54QSbOgrQgcH6Z7qBDZ8x:0uPrpT/qY24c5+3bjXSl4f5rQbaZQd8x
- TLSH
  T1F8232A0037E9C12BF2BE4B7899F26145867AF6632A03D58E1CC411DB5713FC69B426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2