asyncrat | 0c3a4c15f748dcc924cf03d911fa0d4e6e9698acffe30ab9b8056931c6c1dbf3

Sharing

Copy URL Twitter E-mail

General

Target
0c3a4c15f748dcc924cf03d911fa0d4e6e9698acffe30ab9b8056931c6c1dbf3
Size 45KB
Sample260717-rtjrhads6r
SHA256 0c3a4c15f748dcc924cf03d911fa0d4e6e9698acffe30ab9b8056931c6c1dbf3
MD5 adb2dd4cd662565e5162df9d8a05c695
SHA1 6504a75f64f3998fbd469414dc09af639436eccf
SHA512 204064b54b22cb2f704e298f765eaa4bd007f491695bf0dcfea0c5b78b0abe79a5ff57b27ff8d91b86894cd81e6c1be99d39a9f4205a64de34920a1a32ef9aea
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAKT2Qpm7PIGFjbOgX3iTEIM9liw10fBDZcx:UuKWgSJTwRf2BeGNbxXSTTMHB10pdcx
TLSH
T15C232B003BE9812BF2BE4FB8ACF26105467AF6633603D5496CC451D75623BC6CA426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexsexviet.com:80
sexsexviet.com:22
sexsexviet.com:8080
sexsexviet.com:8880
sexsexviet.com:2052
sexsexviet.com:2082
sexsexviet.com:2086
sexsexviet.com:2095
sexsexviet.com:443
sexsexviet.com:2053
sexsexviet.com:2083
sexsexviet.com:2087
sexsexviet.com:2096
sexsexviet.com:8443
www.sexsexviet.com:80
www.sexsexviet.com:22
www.sexsexviet.com:8080
www.sexsexviet.com:8880
www.sexsexviet.com:2052
www.sexsexviet.com:2082
www.sexsexviet.com:2086
www.sexsexviet.com:2095
www.sexsexviet.com:443
www.sexsexviet.com:2053
www.sexsexviet.com:2083
www.sexsexviet.com:2087
www.sexsexviet.com:2096
www.sexsexviet.com:8443
wannacry.sexsexviet.com:80
wannacry.sexsexviet.com:22
wannacry.sexsexviet.com:8080
wannacry.sexsexviet.com:8880
wannacry.sexsexviet.com:2052
wannacry.sexsexviet.com:2082
wannacry.sexsexviet.com:2086
wannacry.sexsexviet.com:2095
wannacry.sexsexviet.com:443
wannacry.sexsexviet.com:2053
wannacry.sexsexviet.com:2083
wannacry.sexsexviet.com:2087
wannacry.sexsexviet.com:2096
wannacry.sexsexviet.com:8443
invasive.sexsexviet.com:80
invasive.sexsexviet.com:22
invasive.sexsexviet.com:8080
invasive.sexsexviet.com:8880
invasive.sexsexviet.com:2052
invasive.sexsexviet.com:2082
invasive.sexsexviet.com:2086
invasive.sexsexviet.com:2095
invasive.sexsexviet.com:443
invasive.sexsexviet.com:2053
invasive.sexsexviet.com:2083
invasive.sexsexviet.com:2087
invasive.sexsexviet.com:2096
invasive.sexsexviet.com:8443
sodinokibi.sexsexviet.com:80
sodinokibi.sexsexviet.com:22
sodinokibi.sexsexviet.com:8080
sodinokibi.sexsexviet.com:8880
sodinokibi.sexsexviet.com:2052
sodinokibi.sexsexviet.com:2082
sodinokibi.sexsexviet.com:2086
sodinokibi.sexsexviet.com:2095
sodinokibi.sexsexviet.com:443
sodinokibi.sexsexviet.com:2053
sodinokibi.sexsexviet.com:2083
sodinokibi.sexsexviet.com:2087
sodinokibi.sexsexviet.com:2096
sodinokibi.sexsexviet.com:8443
rat.sexsexviet.com:80
rat.sexsexviet.com:22
rat.sexsexviet.com:8080
rat.sexsexviet.com:8880
rat.sexsexviet.com:2052
rat.sexsexviet.com:2082
rat.sexsexviet.com:2086
rat.sexsexviet.com:2095
rat.sexsexviet.com:443
rat.sexsexviet.com:2053
rat.sexsexviet.com:2083
rat.sexsexviet.com:2087
rat.sexsexviet.com:2096
rat.sexsexviet.com:8443

Mutex

MhCXwYCWZteb

Attributes

delay
0
install
true
install_file
lj4cps66.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  0c3a4c15f748dcc924cf03d911fa0d4e6e9698acffe30ab9b8056931c6c1dbf3
- Size 45KB
- SHA256 0c3a4c15f748dcc924cf03d911fa0d4e6e9698acffe30ab9b8056931c6c1dbf3
- MD5 adb2dd4cd662565e5162df9d8a05c695
- SHA1 6504a75f64f3998fbd469414dc09af639436eccf
- SHA512 204064b54b22cb2f704e298f765eaa4bd007f491695bf0dcfea0c5b78b0abe79a5ff57b27ff8d91b86894cd81e6c1be99d39a9f4205a64de34920a1a32ef9aea
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAKT2Qpm7PIGFjbOgX3iTEIM9liw10fBDZcx:UuKWgSJTwRf2BeGNbxXSTTMHB10pdcx
- TLSH
  T15C232B003BE9812BF2BE4FB8ACF26105467AF6633603D5496CC451D75623BC6CA426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2