asyncrat | 12e2252a7dcee424a63317d3800dd4eec7aff2d7855d0a8813fdeeb18c9e62cf

Sharing

Copy URL Twitter E-mail

General

Target
12e2252a7dcee424a63317d3800dd4eec7aff2d7855d0a8813fdeeb18c9e62cf
Size 45KB
Sample260717-ry3p6sdt7j
SHA256 12e2252a7dcee424a63317d3800dd4eec7aff2d7855d0a8813fdeeb18c9e62cf
MD5 136ff272323c69e401c07ce5475b540d
SHA1 d5b4119648874f85f936bdeab663b78c78dfa845
SHA512 1e0ff27e209b9d3434eae5484198c314bda9ea73d109c6238421b5151f5d389bcb19ab1075b7c93fad6aae145a06c85cd08eb8b5f8efba05ef0698250cccb68b
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1QFaPklZL3API+zjbpgX3ikeszQErCdPkUZgBDZW:cu6YepTPso2dEkfL3l+3bmXSgzQETs20
TLSH
T1A6231A003BE9813BF2BE4F78A9F26145867AF6737602D6491CC441DB4723BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexsexviet.com:80
sexsexviet.com:22
sexsexviet.com:8080
sexsexviet.com:8880
sexsexviet.com:2052
sexsexviet.com:2082
sexsexviet.com:2086
sexsexviet.com:2095
sexsexviet.com:443
sexsexviet.com:2053
sexsexviet.com:2083
sexsexviet.com:2087
sexsexviet.com:2096
sexsexviet.com:8443
www.sexsexviet.com:80
www.sexsexviet.com:22
www.sexsexviet.com:8080
www.sexsexviet.com:8880
www.sexsexviet.com:2052
www.sexsexviet.com:2082
www.sexsexviet.com:2086
www.sexsexviet.com:2095
www.sexsexviet.com:443
www.sexsexviet.com:2053
www.sexsexviet.com:2083
www.sexsexviet.com:2087
www.sexsexviet.com:2096
www.sexsexviet.com:8443
sasser.sexsexviet.com:80
sasser.sexsexviet.com:22
sasser.sexsexviet.com:8080
sasser.sexsexviet.com:8880
sasser.sexsexviet.com:2052
sasser.sexsexviet.com:2082
sasser.sexsexviet.com:2086
sasser.sexsexviet.com:2095
sasser.sexsexviet.com:443
sasser.sexsexviet.com:2053
sasser.sexsexviet.com:2083
sasser.sexsexviet.com:2087
sasser.sexsexviet.com:2096
sasser.sexsexviet.com:8443
nimda.sexsexviet.com:80
nimda.sexsexviet.com:22
nimda.sexsexviet.com:8080
nimda.sexsexviet.com:8880
nimda.sexsexviet.com:2052
nimda.sexsexviet.com:2082
nimda.sexsexviet.com:2086
nimda.sexsexviet.com:2095
nimda.sexsexviet.com:443
nimda.sexsexviet.com:2053
nimda.sexsexviet.com:2083
nimda.sexsexviet.com:2087
nimda.sexsexviet.com:2096
nimda.sexsexviet.com:8443
ursnif.sexsexviet.com:80
ursnif.sexsexviet.com:22
ursnif.sexsexviet.com:8080
ursnif.sexsexviet.com:8880
ursnif.sexsexviet.com:2052
ursnif.sexsexviet.com:2082
ursnif.sexsexviet.com:2086
ursnif.sexsexviet.com:2095
ursnif.sexsexviet.com:443
ursnif.sexsexviet.com:2053
ursnif.sexsexviet.com:2083
ursnif.sexsexviet.com:2087
ursnif.sexsexviet.com:2096
ursnif.sexsexviet.com:8443

Mutex

eliA21LNYvcD

Attributes

delay
0
install
true
install_file
vxwawvoy.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  12e2252a7dcee424a63317d3800dd4eec7aff2d7855d0a8813fdeeb18c9e62cf
- Size 45KB
- SHA256 12e2252a7dcee424a63317d3800dd4eec7aff2d7855d0a8813fdeeb18c9e62cf
- MD5 136ff272323c69e401c07ce5475b540d
- SHA1 d5b4119648874f85f936bdeab663b78c78dfa845
- SHA512 1e0ff27e209b9d3434eae5484198c314bda9ea73d109c6238421b5151f5d389bcb19ab1075b7c93fad6aae145a06c85cd08eb8b5f8efba05ef0698250cccb68b
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1QFaPklZL3API+zjbpgX3ikeszQErCdPkUZgBDZW:cu6YepTPso2dEkfL3l+3bmXSgzQETs20
- TLSH
  T1A6231A003BE9813BF2BE4F78A9F26145867AF6737602D6491CC441DB4723BC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2