asyncrat | 354eec9d9c3faa453eb54d0d7c1ced288c3d6075eae99e4dfa9134c6762af586

Sharing

Copy URL Twitter E-mail

General

Target
354eec9d9c3faa453eb54d0d7c1ced288c3d6075eae99e4dfa9134c6762af586
Size 45KB
Sample260717-rb4nyscx5k
SHA256 354eec9d9c3faa453eb54d0d7c1ced288c3d6075eae99e4dfa9134c6762af586
MD5 826499204149d0752ae26c69f5631502
SHA1 b03b2a0952fc70e6c6a944f232c05085e9501be6
SHA512 1421ca26592847d502f2f12faa2c64c4e838600f909ce71b6afa69b2e90d432ab5503736b2c6dd2984b075fcc90dc3666e44f70ebb0d2e00109338aee1e5e3bd
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9IQ6vincPI9NjbSgX3i2nBDEGBzfq6cVLMTBDZsx:EufspTf2g2sKU9FbVXSGgG0y1dsx
TLSH
T1D8232A0037E8C12BF2BE5F789DF26245467AB6632603D64D1CC4519B5723FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexnga.store:80
sexnga.store:22
sexnga.store:8080
sexnga.store:8880
sexnga.store:2052
sexnga.store:2082
sexnga.store:2086
sexnga.store:2095
sexnga.store:443
sexnga.store:2053
sexnga.store:2083
sexnga.store:2087
sexnga.store:2096
sexnga.store:8443
www.sexnga.store:80
www.sexnga.store:22
www.sexnga.store:8080
www.sexnga.store:8880
www.sexnga.store:2052
www.sexnga.store:2082
www.sexnga.store:2086
www.sexnga.store:2095
www.sexnga.store:443
www.sexnga.store:2053
www.sexnga.store:2083
www.sexnga.store:2087
www.sexnga.store:2096
www.sexnga.store:8443
qbot.sexnga.store:80
qbot.sexnga.store:22
qbot.sexnga.store:8080
qbot.sexnga.store:8880
qbot.sexnga.store:2052
qbot.sexnga.store:2082
qbot.sexnga.store:2086
qbot.sexnga.store:2095
qbot.sexnga.store:443
qbot.sexnga.store:2053
qbot.sexnga.store:2083
qbot.sexnga.store:2087
qbot.sexnga.store:2096
qbot.sexnga.store:8443
klez.sexnga.store:80
klez.sexnga.store:22
klez.sexnga.store:8080
klez.sexnga.store:8880
klez.sexnga.store:2052
klez.sexnga.store:2082
klez.sexnga.store:2086
klez.sexnga.store:2095
klez.sexnga.store:443
klez.sexnga.store:2053
klez.sexnga.store:2083
klez.sexnga.store:2087
klez.sexnga.store:2096
klez.sexnga.store:8443
codered.sexnga.store:80
codered.sexnga.store:22
codered.sexnga.store:8080
codered.sexnga.store:8880
codered.sexnga.store:2052
codered.sexnga.store:2082
codered.sexnga.store:2086
codered.sexnga.store:2095
codered.sexnga.store:443
codered.sexnga.store:2053
codered.sexnga.store:2083
codered.sexnga.store:2087
codered.sexnga.store:2096
codered.sexnga.store:8443
clop.sexnga.store:80
clop.sexnga.store:22
clop.sexnga.store:8080
clop.sexnga.store:8880
clop.sexnga.store:2052
clop.sexnga.store:2082
clop.sexnga.store:2086
clop.sexnga.store:2095
clop.sexnga.store:443
clop.sexnga.store:2053
clop.sexnga.store:2083
clop.sexnga.store:2087
clop.sexnga.store:2096
clop.sexnga.store:8443

Mutex

EEAK1MUkYOKQ

Attributes

delay
0
install
true
install_file
xw1qa7e.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  354eec9d9c3faa453eb54d0d7c1ced288c3d6075eae99e4dfa9134c6762af586
- Size 45KB
- SHA256 354eec9d9c3faa453eb54d0d7c1ced288c3d6075eae99e4dfa9134c6762af586
- MD5 826499204149d0752ae26c69f5631502
- SHA1 b03b2a0952fc70e6c6a944f232c05085e9501be6
- SHA512 1421ca26592847d502f2f12faa2c64c4e838600f909ce71b6afa69b2e90d432ab5503736b2c6dd2984b075fcc90dc3666e44f70ebb0d2e00109338aee1e5e3bd
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9IQ6vincPI9NjbSgX3i2nBDEGBzfq6cVLMTBDZsx:EufspTf2g2sKU9FbVXSGgG0y1dsx
- TLSH
  T1D8232A0037E8C12BF2BE5F789DF26245467AB6632603D64D1CC4519B5723FC68A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2