asyncrat | 24b97f8611a8aa44d2fe1b0cb17a402d363922af143a5058b18276f7529ea05d

Sharing

Copy URL Twitter E-mail

General

Target
24b97f8611a8aa44d2fe1b0cb17a402d363922af143a5058b18276f7529ea05d
Size 45KB
Sample260716-mlb98saw5l
SHA256 24b97f8611a8aa44d2fe1b0cb17a402d363922af143a5058b18276f7529ea05d
MD5 550c53eeab3399fce6e42236cc083af0
SHA1 fb40a53733cebaffc6b7c4f533f3c1378c4a7d8f
SHA512 a935737994f25c8c73aeaf7b5a70a8b809590000d03b6f9ed5f50c4a3b0b14de50f63df3d8a0fca1bf8da5047161372aaa4dc82dbd5a9133cd6d3c81aa4ff61c
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YSkqXzNOPISzjbsg33iWocbTDJP7ICrNBDZsx:EufspTf2g2maVq3S3bj3SBc3VjICrDdu
TLSH
T181232A003BE9C12BF2BE4F7499F26145867AF2633603D64A1CC4519B5713FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vuasexviet.com:80
vuasexviet.com:22
vuasexviet.com:8080
vuasexviet.com:8880
vuasexviet.com:2052
vuasexviet.com:2082
vuasexviet.com:2086
vuasexviet.com:2095
vuasexviet.com:443
vuasexviet.com:2053
vuasexviet.com:2083
vuasexviet.com:2087
vuasexviet.com:2096
vuasexviet.com:8443
www.vuasexviet.com:80
www.vuasexviet.com:22
www.vuasexviet.com:8080
www.vuasexviet.com:8880
www.vuasexviet.com:2052
www.vuasexviet.com:2082
www.vuasexviet.com:2086
www.vuasexviet.com:2095
www.vuasexviet.com:443
www.vuasexviet.com:2053
www.vuasexviet.com:2083
www.vuasexviet.com:2087
www.vuasexviet.com:2096
www.vuasexviet.com:8443
gootloader.vuasexviet.com:80
gootloader.vuasexviet.com:22
gootloader.vuasexviet.com:8080
gootloader.vuasexviet.com:8880
gootloader.vuasexviet.com:2052
gootloader.vuasexviet.com:2082
gootloader.vuasexviet.com:2086
gootloader.vuasexviet.com:2095
gootloader.vuasexviet.com:443
gootloader.vuasexviet.com:2053
gootloader.vuasexviet.com:2083
gootloader.vuasexviet.com:2087
gootloader.vuasexviet.com:2096
gootloader.vuasexviet.com:8443
hacker.vuasexviet.com:80
hacker.vuasexviet.com:22
hacker.vuasexviet.com:8080
hacker.vuasexviet.com:8880
hacker.vuasexviet.com:2052
hacker.vuasexviet.com:2082
hacker.vuasexviet.com:2086
hacker.vuasexviet.com:2095
hacker.vuasexviet.com:443
hacker.vuasexviet.com:2053
hacker.vuasexviet.com:2083
hacker.vuasexviet.com:2087
hacker.vuasexviet.com:2096
hacker.vuasexviet.com:8443
zbot.vuasexviet.com:80
zbot.vuasexviet.com:22
zbot.vuasexviet.com:8080
zbot.vuasexviet.com:8880
zbot.vuasexviet.com:2052
zbot.vuasexviet.com:2082
zbot.vuasexviet.com:2086
zbot.vuasexviet.com:2095
zbot.vuasexviet.com:443
zbot.vuasexviet.com:2053
zbot.vuasexviet.com:2083
zbot.vuasexviet.com:2087
zbot.vuasexviet.com:2096
zbot.vuasexviet.com:8443

Mutex

Sg0gLCKYGnEr

Attributes

delay
0
install
true
install_file
rcvcq6k.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  24b97f8611a8aa44d2fe1b0cb17a402d363922af143a5058b18276f7529ea05d
- Size 45KB
- SHA256 24b97f8611a8aa44d2fe1b0cb17a402d363922af143a5058b18276f7529ea05d
- MD5 550c53eeab3399fce6e42236cc083af0
- SHA1 fb40a53733cebaffc6b7c4f533f3c1378c4a7d8f
- SHA512 a935737994f25c8c73aeaf7b5a70a8b809590000d03b6f9ed5f50c4a3b0b14de50f63df3d8a0fca1bf8da5047161372aaa4dc82dbd5a9133cd6d3c81aa4ff61c
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YSkqXzNOPISzjbsg33iWocbTDJP7ICrNBDZsx:EufspTf2g2maVq3S3bj3SBc3VjICrDdu
- TLSH
  T181232A003BE9C12BF2BE4F7499F26145867AF2633603D64A1CC4519B5713FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2