asyncrat | b2697d01d9d7d36987512bca2ff43507fa58801839594d425979701209389d7f

Sharing

Copy URL Twitter E-mail

General

Target
b2697d01d9d7d36987512bca2ff43507fa58801839594d425979701209389d7f
Size 45KB
Sample260717-qt62csb13p
SHA256 b2697d01d9d7d36987512bca2ff43507fa58801839594d425979701209389d7f
MD5 fbaa78c812c87b06c5cbea259ce8122e
SHA1 b9430ca04a20fc2d355fffcba95571d7aabb4920
SHA512 a5f3e029f500931535527a14aafbf38c3324632751f65350a04e9c0c95de7e5ae07a48a312e671cd387cb5378b05f40587b9c82fcb33fb42a10690317edddabd
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHy/aKPIbbjbAgX3igO3miuWJXn+l7MMJSBDZsx:EufspTf2g23nhbPbnXS33miXg2dsx
TLSH
T192232B003BE9C12BF2BE8B789DF26145457AF6633A03D54A1CC411DB4713BC69A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexnga.store:80
sexnga.store:22
sexnga.store:8080
sexnga.store:8880
sexnga.store:2052
sexnga.store:2082
sexnga.store:2086
sexnga.store:2095
sexnga.store:443
sexnga.store:2053
sexnga.store:2083
sexnga.store:2087
sexnga.store:2096
sexnga.store:8443
www.sexnga.store:80
www.sexnga.store:22
www.sexnga.store:8080
www.sexnga.store:8880
www.sexnga.store:2052
www.sexnga.store:2082
www.sexnga.store:2086
www.sexnga.store:2095
www.sexnga.store:443
www.sexnga.store:2053
www.sexnga.store:2083
www.sexnga.store:2087
www.sexnga.store:2096
www.sexnga.store:8443
conti.sexnga.store:80
conti.sexnga.store:22
conti.sexnga.store:8080
conti.sexnga.store:8880
conti.sexnga.store:2052
conti.sexnga.store:2082
conti.sexnga.store:2086
conti.sexnga.store:2095
conti.sexnga.store:443
conti.sexnga.store:2053
conti.sexnga.store:2083
conti.sexnga.store:2087
conti.sexnga.store:2096
conti.sexnga.store:8443
notpetya.sexnga.store:80
notpetya.sexnga.store:22
notpetya.sexnga.store:8080
notpetya.sexnga.store:8880
notpetya.sexnga.store:2052
notpetya.sexnga.store:2082
notpetya.sexnga.store:2086
notpetya.sexnga.store:2095
notpetya.sexnga.store:443
notpetya.sexnga.store:2053
notpetya.sexnga.store:2083
notpetya.sexnga.store:2087
notpetya.sexnga.store:2096
notpetya.sexnga.store:8443
darkside.sexnga.store:80
darkside.sexnga.store:22
darkside.sexnga.store:8080
darkside.sexnga.store:8880
darkside.sexnga.store:2052
darkside.sexnga.store:2082
darkside.sexnga.store:2086
darkside.sexnga.store:2095
darkside.sexnga.store:443
darkside.sexnga.store:2053
darkside.sexnga.store:2083
darkside.sexnga.store:2087
darkside.sexnga.store:2096
darkside.sexnga.store:8443
rat.sexnga.store:80
rat.sexnga.store:22
rat.sexnga.store:8080
rat.sexnga.store:8880
rat.sexnga.store:2052
rat.sexnga.store:2082
rat.sexnga.store:2086
rat.sexnga.store:2095
rat.sexnga.store:443
rat.sexnga.store:2053
rat.sexnga.store:2083
rat.sexnga.store:2087
rat.sexnga.store:2096
rat.sexnga.store:8443

Mutex

LBi8v4UK97vc

Attributes

delay
0
install
true
install_file
4djp4c7.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b2697d01d9d7d36987512bca2ff43507fa58801839594d425979701209389d7f
- Size 45KB
- SHA256 b2697d01d9d7d36987512bca2ff43507fa58801839594d425979701209389d7f
- MD5 fbaa78c812c87b06c5cbea259ce8122e
- SHA1 b9430ca04a20fc2d355fffcba95571d7aabb4920
- SHA512 a5f3e029f500931535527a14aafbf38c3324632751f65350a04e9c0c95de7e5ae07a48a312e671cd387cb5378b05f40587b9c82fcb33fb42a10690317edddabd
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHy/aKPIbbjbAgX3igO3miuWJXn+l7MMJSBDZsx:EufspTf2g23nhbPbnXS33miXg2dsx
- TLSH
  T192232B003BE9C12BF2BE8B789DF26145457AF6633A03D54A1CC411DB4713BC69A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2