asyncrat | 97f7660636aa4810794455652619e468eaccc68d500ac40dd32b7faa5ebb6346

Sharing

Copy URL Twitter E-mail

General

Target
97f7660636aa4810794455652619e468eaccc68d500ac40dd32b7faa5ebb6346
Size 45KB
Sample260718-nz5pdaav9j
SHA256 97f7660636aa4810794455652619e468eaccc68d500ac40dd32b7faa5ebb6346
MD5 af39bb9348ee442c28ce375e25b0480e
SHA1 21ff25a3033ea05f8dac71e930817c9cd9d31646
SHA512 866e9804073be1f3aed2393f36f75affb763386dd93fe1b1bb273f7b028beb205928cfb88f387acc3b3e7d9199de85a62acbb2b1049f413342b7d1d91f8c3c5d
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwIeeXKSocbbbQtN8/nPI6kzjbUgX3i/fVpfSRh2jhv:ku40ZTXEb2VeH2tNKA6k3b7XSDSciNdO
TLSH
T1E0231A003BE8812BF2BF4F7859F26145867AF2732603E59A1CC451DB5723BC6DA426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexnga.store:80
sexnga.store:22
sexnga.store:8080
sexnga.store:8880
sexnga.store:2052
sexnga.store:2082
sexnga.store:2086
sexnga.store:2095
sexnga.store:443
sexnga.store:2053
sexnga.store:2083
sexnga.store:2087
sexnga.store:2096
sexnga.store:8443
www.sexnga.store:80
www.sexnga.store:22
www.sexnga.store:8080
www.sexnga.store:8880
www.sexnga.store:2052
www.sexnga.store:2082
www.sexnga.store:2086
www.sexnga.store:2095
www.sexnga.store:443
www.sexnga.store:2053
www.sexnga.store:2083
www.sexnga.store:2087
www.sexnga.store:2096
www.sexnga.store:8443
cryptolocker.sexnga.store:80
cryptolocker.sexnga.store:22
cryptolocker.sexnga.store:8080
cryptolocker.sexnga.store:8880
cryptolocker.sexnga.store:2052
cryptolocker.sexnga.store:2082
cryptolocker.sexnga.store:2086
cryptolocker.sexnga.store:2095
cryptolocker.sexnga.store:443
cryptolocker.sexnga.store:2053
cryptolocker.sexnga.store:2083
cryptolocker.sexnga.store:2087
cryptolocker.sexnga.store:2096
cryptolocker.sexnga.store:8443
ursnif.sexnga.store:80
ursnif.sexnga.store:22
ursnif.sexnga.store:8080
ursnif.sexnga.store:8880
ursnif.sexnga.store:2052
ursnif.sexnga.store:2082
ursnif.sexnga.store:2086
ursnif.sexnga.store:2095
ursnif.sexnga.store:443
ursnif.sexnga.store:2053
ursnif.sexnga.store:2083
ursnif.sexnga.store:2087
ursnif.sexnga.store:2096
ursnif.sexnga.store:8443
hacker.sexnga.store:80
hacker.sexnga.store:22
hacker.sexnga.store:8080
hacker.sexnga.store:8880
hacker.sexnga.store:2052
hacker.sexnga.store:2082
hacker.sexnga.store:2086
hacker.sexnga.store:2095
hacker.sexnga.store:443
hacker.sexnga.store:2053
hacker.sexnga.store:2083
hacker.sexnga.store:2087
hacker.sexnga.store:2096
hacker.sexnga.store:8443
hack.sexnga.store:80
hack.sexnga.store:22
hack.sexnga.store:8080
hack.sexnga.store:8880
hack.sexnga.store:2052
hack.sexnga.store:2082
hack.sexnga.store:2086
hack.sexnga.store:2095
hack.sexnga.store:443
hack.sexnga.store:2053
hack.sexnga.store:2083
hack.sexnga.store:2087
hack.sexnga.store:2096
hack.sexnga.store:8443

Mutex

2Bw5YndIyflL

Attributes

delay
0
install
true
install_file
vr5gx.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  97f7660636aa4810794455652619e468eaccc68d500ac40dd32b7faa5ebb6346
- Size 45KB
- SHA256 97f7660636aa4810794455652619e468eaccc68d500ac40dd32b7faa5ebb6346
- MD5 af39bb9348ee442c28ce375e25b0480e
- SHA1 21ff25a3033ea05f8dac71e930817c9cd9d31646
- SHA512 866e9804073be1f3aed2393f36f75affb763386dd93fe1b1bb273f7b028beb205928cfb88f387acc3b3e7d9199de85a62acbb2b1049f413342b7d1d91f8c3c5d
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwIeeXKSocbbbQtN8/nPI6kzjbUgX3i/fVpfSRh2jhv:ku40ZTXEb2VeH2tNKA6k3b7XSDSciNdO
- TLSH
  T1E0231A003BE8812BF2BF4F7859F26145867AF2732603E59A1CC451DB5723BC6DA426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2