asyncrat | 08c1d017b7e2cc20b06a22969fa20768cabc13b3d4af28943f96cc8fd84d51e2

Sharing

Copy URL Twitter E-mail

General

Target
08c1d017b7e2cc20b06a22969fa20768cabc13b3d4af28943f96cc8fd84d51e2
Size 45KB
Sample260717-rb4zqagx3w
SHA256 08c1d017b7e2cc20b06a22969fa20768cabc13b3d4af28943f96cc8fd84d51e2
MD5 5a1feaf0a8b5ef68ba5e72670d3dbacc
SHA1 b25bc114fa1621d10bbf47f561d3b5a96a5ab421
SHA512 5e36f599df5f8dbba90cbdc755a393b15019dbb4a57d47bc2f3106d62054c05f10fc4e67f8dcbb0b9d31a63a76e4b975be1d5fdb36a0806b245ebbcf2acfc932
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4wO5QPCBAPSNjPIRzjblgX3iFrBqczohLuxAh1+BU:8uUIpT4vAj20O5svSKR3biXSRBf8hLu+
TLSH
T1CB232A003BE8812BF2BE5F7899F26145467AF6633603E5892CC451DB5723FC686426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vuasexviet.com:80
vuasexviet.com:22
vuasexviet.com:8080
vuasexviet.com:8880
vuasexviet.com:2052
vuasexviet.com:2082
vuasexviet.com:2086
vuasexviet.com:2095
vuasexviet.com:443
vuasexviet.com:2053
vuasexviet.com:2083
vuasexviet.com:2087
vuasexviet.com:2096
vuasexviet.com:8443
www.vuasexviet.com:80
www.vuasexviet.com:22
www.vuasexviet.com:8080
www.vuasexviet.com:8880
www.vuasexviet.com:2052
www.vuasexviet.com:2082
www.vuasexviet.com:2086
www.vuasexviet.com:2095
www.vuasexviet.com:443
www.vuasexviet.com:2053
www.vuasexviet.com:2083
www.vuasexviet.com:2087
www.vuasexviet.com:2096
www.vuasexviet.com:8443
revil.vuasexviet.com:80
revil.vuasexviet.com:22
revil.vuasexviet.com:8080
revil.vuasexviet.com:8880
revil.vuasexviet.com:2052
revil.vuasexviet.com:2082
revil.vuasexviet.com:2086
revil.vuasexviet.com:2095
revil.vuasexviet.com:443
revil.vuasexviet.com:2053
revil.vuasexviet.com:2083
revil.vuasexviet.com:2087
revil.vuasexviet.com:2096
revil.vuasexviet.com:8443
hacker.vuasexviet.com:80
hacker.vuasexviet.com:22
hacker.vuasexviet.com:8080
hacker.vuasexviet.com:8880
hacker.vuasexviet.com:2052
hacker.vuasexviet.com:2082
hacker.vuasexviet.com:2086
hacker.vuasexviet.com:2095
hacker.vuasexviet.com:443
hacker.vuasexviet.com:2053
hacker.vuasexviet.com:2083
hacker.vuasexviet.com:2087
hacker.vuasexviet.com:2096
hacker.vuasexviet.com:8443
hack.vuasexviet.com:80
hack.vuasexviet.com:22
hack.vuasexviet.com:8080
hack.vuasexviet.com:8880
hack.vuasexviet.com:2052
hack.vuasexviet.com:2082
hack.vuasexviet.com:2086
hack.vuasexviet.com:2095
hack.vuasexviet.com:443
hack.vuasexviet.com:2053
hack.vuasexviet.com:2083
hack.vuasexviet.com:2087
hack.vuasexviet.com:2096
hack.vuasexviet.com:8443
remote.vuasexviet.com:80
remote.vuasexviet.com:22
remote.vuasexviet.com:8080
remote.vuasexviet.com:8880
remote.vuasexviet.com:2052
remote.vuasexviet.com:2082
remote.vuasexviet.com:2086
remote.vuasexviet.com:2095
remote.vuasexviet.com:443
remote.vuasexviet.com:2053
remote.vuasexviet.com:2083
remote.vuasexviet.com:2087
remote.vuasexviet.com:2096
remote.vuasexviet.com:8443

Mutex

gcf5BRVudIzB

Attributes

delay
0
install
true
install_file
mmu3ccu.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  08c1d017b7e2cc20b06a22969fa20768cabc13b3d4af28943f96cc8fd84d51e2
- Size 45KB
- SHA256 08c1d017b7e2cc20b06a22969fa20768cabc13b3d4af28943f96cc8fd84d51e2
- MD5 5a1feaf0a8b5ef68ba5e72670d3dbacc
- SHA1 b25bc114fa1621d10bbf47f561d3b5a96a5ab421
- SHA512 5e36f599df5f8dbba90cbdc755a393b15019dbb4a57d47bc2f3106d62054c05f10fc4e67f8dcbb0b9d31a63a76e4b975be1d5fdb36a0806b245ebbcf2acfc932
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4wO5QPCBAPSNjPIRzjblgX3iFrBqczohLuxAh1+BU:8uUIpT4vAj20O5svSKR3biXSRBf8hLu+
- TLSH
  T1CB232A003BE8812BF2BE5F7899F26145467AF6633603E5892CC451DB5723FC686426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2