asyncrat | 29f503d7dc48a6482f6ed4e5c92a610dd233871c0f514609d5a91753d2dceb1d

Sharing

Copy URL Twitter E-mail

General

Target
29f503d7dc48a6482f6ed4e5c92a610dd233871c0f514609d5a91753d2dceb1d
Size 45KB
Sample260717-tpfv6aaz3z
SHA256 29f503d7dc48a6482f6ed4e5c92a610dd233871c0f514609d5a91753d2dceb1d
MD5 7708fc7fbf5a052d445f605b3621ac13
SHA1 82d1c4e9df1ad2580aa1fd6640471789554e1a8e
SHA512 81fb9269e66a6068ffbd3b802278ecbee01e1b49c2ed6b3e1518cbd5a4ae953c9d67da9e2a28f2eff3b3bb06932141a8bee38a19bf5136d0c7d65b218c26b5d5
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFUlsNoPEaMPIcsjbZgX3iEZmr3kJQ3iBDZEx:MuLAZTnbg2tsuEaxccb2XSXjgkcdEx
TLSH
T15F231A003BE8822BF2BE4F789DF26145467EF6B32603D54A1CC451DB5613FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexnga.store:80
sexnga.store:22
sexnga.store:8080
sexnga.store:8880
sexnga.store:2052
sexnga.store:2082
sexnga.store:2086
sexnga.store:2095
sexnga.store:443
sexnga.store:2053
sexnga.store:2083
sexnga.store:2087
sexnga.store:2096
sexnga.store:8443
www.sexnga.store:80
www.sexnga.store:22
www.sexnga.store:8080
www.sexnga.store:8880
www.sexnga.store:2052
www.sexnga.store:2082
www.sexnga.store:2086
www.sexnga.store:2095
www.sexnga.store:443
www.sexnga.store:2053
www.sexnga.store:2083
www.sexnga.store:2087
www.sexnga.store:2096
www.sexnga.store:8443
conti.sexnga.store:80
conti.sexnga.store:22
conti.sexnga.store:8080
conti.sexnga.store:8880
conti.sexnga.store:2052
conti.sexnga.store:2082
conti.sexnga.store:2086
conti.sexnga.store:2095
conti.sexnga.store:443
conti.sexnga.store:2053
conti.sexnga.store:2083
conti.sexnga.store:2087
conti.sexnga.store:2096
conti.sexnga.store:8443
downadup.sexnga.store:80
downadup.sexnga.store:22
downadup.sexnga.store:8080
downadup.sexnga.store:8880
downadup.sexnga.store:2052
downadup.sexnga.store:2082
downadup.sexnga.store:2086
downadup.sexnga.store:2095
downadup.sexnga.store:443
downadup.sexnga.store:2053
downadup.sexnga.store:2083
downadup.sexnga.store:2087
downadup.sexnga.store:2096
downadup.sexnga.store:8443
client.sexnga.store:80
client.sexnga.store:22
client.sexnga.store:8080
client.sexnga.store:8880
client.sexnga.store:2052
client.sexnga.store:2082
client.sexnga.store:2086
client.sexnga.store:2095
client.sexnga.store:443
client.sexnga.store:2053
client.sexnga.store:2083
client.sexnga.store:2087
client.sexnga.store:2096
client.sexnga.store:8443
stuxnet.sexnga.store:80
stuxnet.sexnga.store:22
stuxnet.sexnga.store:8080
stuxnet.sexnga.store:8880
stuxnet.sexnga.store:2052
stuxnet.sexnga.store:2082
stuxnet.sexnga.store:2086
stuxnet.sexnga.store:2095
stuxnet.sexnga.store:443
stuxnet.sexnga.store:2053
stuxnet.sexnga.store:2083
stuxnet.sexnga.store:2087
stuxnet.sexnga.store:2096
stuxnet.sexnga.store:8443

Mutex

kDBvG5Ub8Hzw

Attributes

delay
0
install
true
install_file
phlzc.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  29f503d7dc48a6482f6ed4e5c92a610dd233871c0f514609d5a91753d2dceb1d
- Size 45KB
- SHA256 29f503d7dc48a6482f6ed4e5c92a610dd233871c0f514609d5a91753d2dceb1d
- MD5 7708fc7fbf5a052d445f605b3621ac13
- SHA1 82d1c4e9df1ad2580aa1fd6640471789554e1a8e
- SHA512 81fb9269e66a6068ffbd3b802278ecbee01e1b49c2ed6b3e1518cbd5a4ae953c9d67da9e2a28f2eff3b3bb06932141a8bee38a19bf5136d0c7d65b218c26b5d5
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFUlsNoPEaMPIcsjbZgX3iEZmr3kJQ3iBDZEx:MuLAZTnbg2tsuEaxccb2XSXjgkcdEx
- TLSH
  T15F231A003BE8822BF2BE4F789DF26145467EF6B32603D54A1CC451DB5613FC69A426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2