asyncrat | 2a9b7c3d216c5a6c880fde69a28869d1a504a217d3e9acc99681c42113bbea4e

Sharing

Copy URL Twitter E-mail

General

Target
2a9b7c3d216c5a6c880fde69a28869d1a504a217d3e9acc99681c42113bbea4e
Size 45KB
Sample260716-qvyrdaew2n
SHA256 2a9b7c3d216c5a6c880fde69a28869d1a504a217d3e9acc99681c42113bbea4e
MD5 92c10f37a2051bf22e9377a1490fab85
SHA1 740028b9375353cef26e8d611f5f35b3887869e9
SHA512 a598c8ea01a654c046e18b3622ecb7fb038a2db8d28e36519e66b104d55ae991ebf21972c7d6ef79e00e8fff856b75a5a99b367c883189e4f7c3b1f2e3c045bc
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OUUwdrxIkDPIOzjb9gX3iGYDI8LntqBdGBDw:MuBGJTPho2fqPTNMO3bqXSG+IwkdIdEx
TLSH
T125231A0037E9C12BF6BE4F74A9F26145867AF6633A03D6491CC441DB5B23BC68642AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vuasexviet.com:80
vuasexviet.com:22
vuasexviet.com:8080
vuasexviet.com:8880
vuasexviet.com:2052
vuasexviet.com:2082
vuasexviet.com:2086
vuasexviet.com:2095
vuasexviet.com:443
vuasexviet.com:2053
vuasexviet.com:2083
vuasexviet.com:2087
vuasexviet.com:2096
vuasexviet.com:8443
www.vuasexviet.com:80
www.vuasexviet.com:22
www.vuasexviet.com:8080
www.vuasexviet.com:8880
www.vuasexviet.com:2052
www.vuasexviet.com:2082
www.vuasexviet.com:2086
www.vuasexviet.com:2095
www.vuasexviet.com:443
www.vuasexviet.com:2053
www.vuasexviet.com:2083
www.vuasexviet.com:2087
www.vuasexviet.com:2096
www.vuasexviet.com:8443
notpetya.vuasexviet.com:80
notpetya.vuasexviet.com:22
notpetya.vuasexviet.com:8080
notpetya.vuasexviet.com:8880
notpetya.vuasexviet.com:2052
notpetya.vuasexviet.com:2082
notpetya.vuasexviet.com:2086
notpetya.vuasexviet.com:2095
notpetya.vuasexviet.com:443
notpetya.vuasexviet.com:2053
notpetya.vuasexviet.com:2083
notpetya.vuasexviet.com:2087
notpetya.vuasexviet.com:2096
notpetya.vuasexviet.com:8443
agenttesla.vuasexviet.com:80
agenttesla.vuasexviet.com:22
agenttesla.vuasexviet.com:8080
agenttesla.vuasexviet.com:8880
agenttesla.vuasexviet.com:2052
agenttesla.vuasexviet.com:2082
agenttesla.vuasexviet.com:2086
agenttesla.vuasexviet.com:2095
agenttesla.vuasexviet.com:443
agenttesla.vuasexviet.com:2053
agenttesla.vuasexviet.com:2083
agenttesla.vuasexviet.com:2087
agenttesla.vuasexviet.com:2096
agenttesla.vuasexviet.com:8443
zbot.vuasexviet.com:80
zbot.vuasexviet.com:22
zbot.vuasexviet.com:8080
zbot.vuasexviet.com:8880
zbot.vuasexviet.com:2052
zbot.vuasexviet.com:2082
zbot.vuasexviet.com:2086
zbot.vuasexviet.com:2095
zbot.vuasexviet.com:443
zbot.vuasexviet.com:2053
zbot.vuasexviet.com:2083
zbot.vuasexviet.com:2087
zbot.vuasexviet.com:2096
zbot.vuasexviet.com:8443

Mutex

755jnJlksZdw

Attributes

delay
0
install
true
install_file
mq10.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2a9b7c3d216c5a6c880fde69a28869d1a504a217d3e9acc99681c42113bbea4e
- Size 45KB
- SHA256 2a9b7c3d216c5a6c880fde69a28869d1a504a217d3e9acc99681c42113bbea4e
- MD5 92c10f37a2051bf22e9377a1490fab85
- SHA1 740028b9375353cef26e8d611f5f35b3887869e9
- SHA512 a598c8ea01a654c046e18b3622ecb7fb038a2db8d28e36519e66b104d55ae991ebf21972c7d6ef79e00e8fff856b75a5a99b367c883189e4f7c3b1f2e3c045bc
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OUUwdrxIkDPIOzjb9gX3iGYDI8LntqBdGBDw:MuBGJTPho2fqPTNMO3bqXSG+IwkdIdEx
- TLSH
  T125231A0037E9C12BF6BE4F74A9F26145867AF6633A03D6491CC441DB5B23BC68642AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2