asyncrat | 9a95a88162a3f620e58c50ac7b3142dc1b440d3ab0783802be05dee9aeddf286

Sharing

Copy URL Twitter E-mail

General

Target
9a95a88162a3f620e58c50ac7b3142dc1b440d3ab0783802be05dee9aeddf286
Size 45KB
Sample260718-ntdzgadv4w
SHA256 9a95a88162a3f620e58c50ac7b3142dc1b440d3ab0783802be05dee9aeddf286
MD5 b3f14617bdbb159e8eaec312412bc838
SHA1 975bd724be972d52724cc26baaee02ea2d06eeaa
SHA512 334705c56d495c14dd99fd0c587b919875929d180e3bbcfd332e2f4dd5ebbb15fb54ec207b2e3fbcf003937d5c662d25128b16dac9fa0680f778ac68028ac3fd
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF4ZTohEaSPIDzjbsgX3i//TCZUJBesMHBDZUx:cu7e5TH2A214Ea7D3bjXSnTjes2dUx
TLSH
T199232B003BE8812BF2BE5F789DF26145467AF6632603D6492CC411DB5613FC6DA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexnga.store:80
sexnga.store:22
sexnga.store:8080
sexnga.store:8880
sexnga.store:2052
sexnga.store:2082
sexnga.store:2086
sexnga.store:2095
sexnga.store:443
sexnga.store:2053
sexnga.store:2083
sexnga.store:2087
sexnga.store:2096
sexnga.store:8443
www.sexnga.store:80
www.sexnga.store:22
www.sexnga.store:8080
www.sexnga.store:8880
www.sexnga.store:2052
www.sexnga.store:2082
www.sexnga.store:2086
www.sexnga.store:2095
www.sexnga.store:443
www.sexnga.store:2053
www.sexnga.store:2083
www.sexnga.store:2087
www.sexnga.store:2096
www.sexnga.store:8443
client.sexnga.store:80
client.sexnga.store:22
client.sexnga.store:8080
client.sexnga.store:8880
client.sexnga.store:2052
client.sexnga.store:2082
client.sexnga.store:2086
client.sexnga.store:2095
client.sexnga.store:443
client.sexnga.store:2053
client.sexnga.store:2083
client.sexnga.store:2087
client.sexnga.store:2096
client.sexnga.store:8443
lokibot.sexnga.store:80
lokibot.sexnga.store:22
lokibot.sexnga.store:8080
lokibot.sexnga.store:8880
lokibot.sexnga.store:2052
lokibot.sexnga.store:2082
lokibot.sexnga.store:2086
lokibot.sexnga.store:2095
lokibot.sexnga.store:443
lokibot.sexnga.store:2053
lokibot.sexnga.store:2083
lokibot.sexnga.store:2087
lokibot.sexnga.store:2096
lokibot.sexnga.store:8443
melissa.sexnga.store:80
melissa.sexnga.store:22
melissa.sexnga.store:8080
melissa.sexnga.store:8880
melissa.sexnga.store:2052
melissa.sexnga.store:2082
melissa.sexnga.store:2086
melissa.sexnga.store:2095
melissa.sexnga.store:443
melissa.sexnga.store:2053
melissa.sexnga.store:2083
melissa.sexnga.store:2087
melissa.sexnga.store:2096
melissa.sexnga.store:8443

Mutex

zCUxWCnwaDwE

Attributes

delay
0
install
true
install_file
qw1x5.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  9a95a88162a3f620e58c50ac7b3142dc1b440d3ab0783802be05dee9aeddf286
- Size 45KB
- SHA256 9a95a88162a3f620e58c50ac7b3142dc1b440d3ab0783802be05dee9aeddf286
- MD5 b3f14617bdbb159e8eaec312412bc838
- SHA1 975bd724be972d52724cc26baaee02ea2d06eeaa
- SHA512 334705c56d495c14dd99fd0c587b919875929d180e3bbcfd332e2f4dd5ebbb15fb54ec207b2e3fbcf003937d5c662d25128b16dac9fa0680f778ac68028ac3fd
- SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF4ZTohEaSPIDzjbsgX3i//TCZUJBesMHBDZUx:cu7e5TH2A214Ea7D3bjXSnTjes2dUx
- TLSH
  T199232B003BE8812BF2BE5F789DF26145467AF6632603D6492CC411DB5613FC6DA426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2