asyncrat | 6c50152cc53075ba9d3850b613776ae91bcce3432d2aebb8c7ef891ab7009f01

Sharing

Copy URL Twitter E-mail

General

Target
6c50152cc53075ba9d3850b613776ae91bcce3432d2aebb8c7ef891ab7009f01
Size 45KB
Sample260718-la8nmae15m
SHA256 6c50152cc53075ba9d3850b613776ae91bcce3432d2aebb8c7ef891ab7009f01
MD5 c289936b5e93a45e2f01973eb2ed54e6
SHA1 09fc9e4515d0a91c53e76fe5dc1f1a716acb15fc
SHA512 6e3284131e63b949f79b0c346f2066f2cb34d06b2dcd738d1337ea05e797cfc8bf1d07308dce5588eb573232b04c08e4bc33ae9e1a8c9584df69c860b682d9ad
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1N8V1RpPEcPIMzjbdgX3iMzu3NPcF5OB6MBDZUx:cuR0JTPjY2+8VDZEhM3bKXSi46KdUx
TLSH
T1A0232B0037E9822BF27E4F789DF26145867EF2672603D54A1CC4519B1623FC6DA42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexnga.store:80
sexnga.store:22
sexnga.store:8080
sexnga.store:8880
sexnga.store:2052
sexnga.store:2082
sexnga.store:2086
sexnga.store:2095
sexnga.store:443
sexnga.store:2053
sexnga.store:2083
sexnga.store:2087
sexnga.store:2096
sexnga.store:8443
www.sexnga.store:80
www.sexnga.store:22
www.sexnga.store:8080
www.sexnga.store:8880
www.sexnga.store:2052
www.sexnga.store:2082
www.sexnga.store:2086
www.sexnga.store:2095
www.sexnga.store:443
www.sexnga.store:2053
www.sexnga.store:2083
www.sexnga.store:2087
www.sexnga.store:2096
www.sexnga.store:8443
dridex.sexnga.store:80
dridex.sexnga.store:22
dridex.sexnga.store:8080
dridex.sexnga.store:8880
dridex.sexnga.store:2052
dridex.sexnga.store:2082
dridex.sexnga.store:2086
dridex.sexnga.store:2095
dridex.sexnga.store:443
dridex.sexnga.store:2053
dridex.sexnga.store:2083
dridex.sexnga.store:2087
dridex.sexnga.store:2096
dridex.sexnga.store:8443
formbook.sexnga.store:80
formbook.sexnga.store:22
formbook.sexnga.store:8080
formbook.sexnga.store:8880
formbook.sexnga.store:2052
formbook.sexnga.store:2082
formbook.sexnga.store:2086
formbook.sexnga.store:2095
formbook.sexnga.store:443
formbook.sexnga.store:2053
formbook.sexnga.store:2083
formbook.sexnga.store:2087
formbook.sexnga.store:2096
formbook.sexnga.store:8443
wannacry.sexnga.store:80
wannacry.sexnga.store:22
wannacry.sexnga.store:8080
wannacry.sexnga.store:8880
wannacry.sexnga.store:2052
wannacry.sexnga.store:2082
wannacry.sexnga.store:2086
wannacry.sexnga.store:2095
wannacry.sexnga.store:443
wannacry.sexnga.store:2053
wannacry.sexnga.store:2083
wannacry.sexnga.store:2087
wannacry.sexnga.store:2096
wannacry.sexnga.store:8443

Mutex

F2KqiPcZBET4

Attributes

delay
0
install
true
install_file
6ueu.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6c50152cc53075ba9d3850b613776ae91bcce3432d2aebb8c7ef891ab7009f01
- Size 45KB
- SHA256 6c50152cc53075ba9d3850b613776ae91bcce3432d2aebb8c7ef891ab7009f01
- MD5 c289936b5e93a45e2f01973eb2ed54e6
- SHA1 09fc9e4515d0a91c53e76fe5dc1f1a716acb15fc
- SHA512 6e3284131e63b949f79b0c346f2066f2cb34d06b2dcd738d1337ea05e797cfc8bf1d07308dce5588eb573232b04c08e4bc33ae9e1a8c9584df69c860b682d9ad
- SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1N8V1RpPEcPIMzjbdgX3iMzu3NPcF5OB6MBDZUx:cuR0JTPjY2+8VDZEhM3bKXSi46KdUx
- TLSH
  T1A0232B0037E9822BF27E4F789DF26145867EF2672603D54A1CC4519B1623FC6DA42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2