asyncrat | d22ec211bbda1c2c49fba73090205f5db83c10a4d76e80d7fcab6ddfe21c5e38

Sharing

Copy URL Twitter E-mail

General

Target
d22ec211bbda1c2c49fba73090205f5db83c10a4d76e80d7fcab6ddfe21c5e38
Size 45KB
Sample260716-lt767sdw7y
SHA256 d22ec211bbda1c2c49fba73090205f5db83c10a4d76e80d7fcab6ddfe21c5e38
MD5 963accbbcf48e1aa2e5d96da4b739ab2
SHA1 b153b3856b97dfc4055353418b3d4d3736cca028
SHA512 99f2e44f492e0996fa372f91f192723e61a7cb4106dbfb196a7a233776a478a0b87d286d1f844ae3e08d2568c303f84b54a226e09525c7536d7d260be45475e8
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwAl9fcBEahPItTjbIgX3ixXvOYxYQtkByeoZBDZMx:ku40ZTXEb2sLkEa+tXbfXSxGH0JdMx
TLSH
T118232B003BE8822BF2BE4F789DF26145857AF5A32603D54A1CC451DB4723FC69A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vuasexviet.com:80
vuasexviet.com:22
vuasexviet.com:8080
vuasexviet.com:8880
vuasexviet.com:2052
vuasexviet.com:2082
vuasexviet.com:2086
vuasexviet.com:2095
vuasexviet.com:443
vuasexviet.com:2053
vuasexviet.com:2083
vuasexviet.com:2087
vuasexviet.com:2096
vuasexviet.com:8443
www.vuasexviet.com:80
www.vuasexviet.com:22
www.vuasexviet.com:8080
www.vuasexviet.com:8880
www.vuasexviet.com:2052
www.vuasexviet.com:2082
www.vuasexviet.com:2086
www.vuasexviet.com:2095
www.vuasexviet.com:443
www.vuasexviet.com:2053
www.vuasexviet.com:2083
www.vuasexviet.com:2087
www.vuasexviet.com:2096
www.vuasexviet.com:8443
zeus.vuasexviet.com:80
zeus.vuasexviet.com:22
zeus.vuasexviet.com:8080
zeus.vuasexviet.com:8880
zeus.vuasexviet.com:2052
zeus.vuasexviet.com:2082
zeus.vuasexviet.com:2086
zeus.vuasexviet.com:2095
zeus.vuasexviet.com:443
zeus.vuasexviet.com:2053
zeus.vuasexviet.com:2083
zeus.vuasexviet.com:2087
zeus.vuasexviet.com:2096
zeus.vuasexviet.com:8443
connect.vuasexviet.com:80
connect.vuasexviet.com:22
connect.vuasexviet.com:8080
connect.vuasexviet.com:8880
connect.vuasexviet.com:2052
connect.vuasexviet.com:2082
connect.vuasexviet.com:2086
connect.vuasexviet.com:2095
connect.vuasexviet.com:443
connect.vuasexviet.com:2053
connect.vuasexviet.com:2083
connect.vuasexviet.com:2087
connect.vuasexviet.com:2096
connect.vuasexviet.com:8443
socgholish.vuasexviet.com:80
socgholish.vuasexviet.com:22
socgholish.vuasexviet.com:8080
socgholish.vuasexviet.com:8880
socgholish.vuasexviet.com:2052
socgholish.vuasexviet.com:2082
socgholish.vuasexviet.com:2086
socgholish.vuasexviet.com:2095
socgholish.vuasexviet.com:443
socgholish.vuasexviet.com:2053
socgholish.vuasexviet.com:2083
socgholish.vuasexviet.com:2087
socgholish.vuasexviet.com:2096
socgholish.vuasexviet.com:8443
nimda.vuasexviet.com:80
nimda.vuasexviet.com:22
nimda.vuasexviet.com:8080
nimda.vuasexviet.com:8880
nimda.vuasexviet.com:2052
nimda.vuasexviet.com:2082
nimda.vuasexviet.com:2086
nimda.vuasexviet.com:2095
nimda.vuasexviet.com:443
nimda.vuasexviet.com:2053
nimda.vuasexviet.com:2083
nimda.vuasexviet.com:2087
nimda.vuasexviet.com:2096
nimda.vuasexviet.com:8443

Mutex

1kccOBZccGRn

Attributes

delay
0
install
true
install_file
pbftd.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  d22ec211bbda1c2c49fba73090205f5db83c10a4d76e80d7fcab6ddfe21c5e38
- Size 45KB
- SHA256 d22ec211bbda1c2c49fba73090205f5db83c10a4d76e80d7fcab6ddfe21c5e38
- MD5 963accbbcf48e1aa2e5d96da4b739ab2
- SHA1 b153b3856b97dfc4055353418b3d4d3736cca028
- SHA512 99f2e44f492e0996fa372f91f192723e61a7cb4106dbfb196a7a233776a478a0b87d286d1f844ae3e08d2568c303f84b54a226e09525c7536d7d260be45475e8
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwAl9fcBEahPItTjbIgX3ixXvOYxYQtkByeoZBDZMx:ku40ZTXEb2sLkEa+tXbfXSxGH0JdMx
- TLSH
  T118232B003BE8822BF2BE4F789DF26145857AF5A32603D54A1CC451DB4723FC69A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2