asyncrat | 85ed1eef48a573234b4c16b9e16c88245a537b00e97248d3b95f156e99b18a28

Sharing

Copy URL Twitter E-mail

General

Target
85ed1eef48a573234b4c16b9e16c88245a537b00e97248d3b95f156e99b18a28
Size 45KB
Sample260718-lqvrpsfv3m
SHA256 85ed1eef48a573234b4c16b9e16c88245a537b00e97248d3b95f156e99b18a28
MD5 c1e99a82a1a221a93b4ae2f5c86ea199
SHA1 8409b3147c6d1bb485e5cb19f2f641c8268884c1
SHA512 e9ca2f1b4557ddca2fb3a58614647d8eaf067a1eae6a519ba0c7ca4b185c0f8fa09060e58e69b70985cbeda4fc51268a24514ac061b528fbc7525f1fcc0c693b
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IxJaxMwHuPIvzjbrgnm3izmlBWoj5h9VEBDZUx:cu6YepTPso2BeN3v3bUnmSzmlB9j57A0
TLSH
T14C232A003BE9812BF2BE4F78A9F26105867EF6632603D64D2CC451DB5623FC19A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexsexviet.com:80
sexsexviet.com:22
sexsexviet.com:8080
sexsexviet.com:8880
sexsexviet.com:2052
sexsexviet.com:2082
sexsexviet.com:2086
sexsexviet.com:2095
sexsexviet.com:443
sexsexviet.com:2053
sexsexviet.com:2083
sexsexviet.com:2087
sexsexviet.com:2096
sexsexviet.com:8443
www.sexsexviet.com:80
www.sexsexviet.com:22
www.sexsexviet.com:8080
www.sexsexviet.com:8880
www.sexsexviet.com:2052
www.sexsexviet.com:2082
www.sexsexviet.com:2086
www.sexsexviet.com:2095
www.sexsexviet.com:443
www.sexsexviet.com:2053
www.sexsexviet.com:2083
www.sexsexviet.com:2087
www.sexsexviet.com:2096
www.sexsexviet.com:8443
downadup.sexsexviet.com:80
downadup.sexsexviet.com:22
downadup.sexsexviet.com:8080
downadup.sexsexviet.com:8880
downadup.sexsexviet.com:2052
downadup.sexsexviet.com:2082
downadup.sexsexviet.com:2086
downadup.sexsexviet.com:2095
downadup.sexsexviet.com:443
downadup.sexsexviet.com:2053
downadup.sexsexviet.com:2083
downadup.sexsexviet.com:2087
downadup.sexsexviet.com:2096
downadup.sexsexviet.com:8443
wannacry.sexsexviet.com:80
wannacry.sexsexviet.com:22
wannacry.sexsexviet.com:8080
wannacry.sexsexviet.com:8880
wannacry.sexsexviet.com:2052
wannacry.sexsexviet.com:2082
wannacry.sexsexviet.com:2086
wannacry.sexsexviet.com:2095
wannacry.sexsexviet.com:443
wannacry.sexsexviet.com:2053
wannacry.sexsexviet.com:2083
wannacry.sexsexviet.com:2087
wannacry.sexsexviet.com:2096
wannacry.sexsexviet.com:8443
triton.sexsexviet.com:80
triton.sexsexviet.com:22
triton.sexsexviet.com:8080
triton.sexsexviet.com:8880
triton.sexsexviet.com:2052
triton.sexsexviet.com:2082
triton.sexsexviet.com:2086
triton.sexsexviet.com:2095
triton.sexsexviet.com:443
triton.sexsexviet.com:2053
triton.sexsexviet.com:2083
triton.sexsexviet.com:2087
triton.sexsexviet.com:2096
triton.sexsexviet.com:8443

Mutex

BUcWCsP5ACyL

Attributes

delay
0
install
true
install_file
jbru0h1k.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  85ed1eef48a573234b4c16b9e16c88245a537b00e97248d3b95f156e99b18a28
- Size 45KB
- SHA256 85ed1eef48a573234b4c16b9e16c88245a537b00e97248d3b95f156e99b18a28
- MD5 c1e99a82a1a221a93b4ae2f5c86ea199
- SHA1 8409b3147c6d1bb485e5cb19f2f641c8268884c1
- SHA512 e9ca2f1b4557ddca2fb3a58614647d8eaf067a1eae6a519ba0c7ca4b185c0f8fa09060e58e69b70985cbeda4fc51268a24514ac061b528fbc7525f1fcc0c693b
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IxJaxMwHuPIvzjbrgnm3izmlBWoj5h9VEBDZUx:cu6YepTPso2BeN3v3bUnmSzmlB9j57A0
- TLSH
  T14C232A003BE9812BF2BE4F78A9F26105867EF6632603D64D2CC451DB5623FC19A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2