asyncrat | 72bb5ffef3db426bdf99bb540d9f7a3a6a9b78d77c2d8b4db56b8ddb99610802

Sharing

Copy URL Twitter E-mail

General

Target
72bb5ffef3db426bdf99bb540d9f7a3a6a9b78d77c2d8b4db56b8ddb99610802
Size 45KB
Sample260718-q2el3scy2k
SHA256 72bb5ffef3db426bdf99bb540d9f7a3a6a9b78d77c2d8b4db56b8ddb99610802
MD5 e9e417c49932ef2405f6a1df74e301f2
SHA1 b99a82617fea49d2dc836d0082e762ccf73ae852
SHA512 006c3d501aa87c1ff7543553472d9eb4aa284df60b1aa2097d67f164e4f968043b8b5662d4c4ae1548d8eb9e15ab4f31b35500810cb64feef3eee6f759039e61
SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ/ZTohEaSPIvzjbsgX3iJ0x21Nta4ikdwP6G5BDZUx:cuqb5TrhG2F4Ea7v3bjXSCxiNAFhiudW
TLSH
T13D231A003BE8822BF2BE4F789DF26245867EB6632603D5491CC451DB5713BC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexsexviet.com:80
sexsexviet.com:22
sexsexviet.com:8080
sexsexviet.com:8880
sexsexviet.com:2052
sexsexviet.com:2082
sexsexviet.com:2086
sexsexviet.com:2095
sexsexviet.com:443
sexsexviet.com:2053
sexsexviet.com:2083
sexsexviet.com:2087
sexsexviet.com:2096
sexsexviet.com:8443
www.sexsexviet.com:80
www.sexsexviet.com:22
www.sexsexviet.com:8080
www.sexsexviet.com:8880
www.sexsexviet.com:2052
www.sexsexviet.com:2082
www.sexsexviet.com:2086
www.sexsexviet.com:2095
www.sexsexviet.com:443
www.sexsexviet.com:2053
www.sexsexviet.com:2083
www.sexsexviet.com:2087
www.sexsexviet.com:2096
www.sexsexviet.com:8443
melissa.sexsexviet.com:80
melissa.sexsexviet.com:22
melissa.sexsexviet.com:8080
melissa.sexsexviet.com:8880
melissa.sexsexviet.com:2052
melissa.sexsexviet.com:2082
melissa.sexsexviet.com:2086
melissa.sexsexviet.com:2095
melissa.sexsexviet.com:443
melissa.sexsexviet.com:2053
melissa.sexsexviet.com:2083
melissa.sexsexviet.com:2087
melissa.sexsexviet.com:2096
melissa.sexsexviet.com:8443
remote.sexsexviet.com:80
remote.sexsexviet.com:22
remote.sexsexviet.com:8080
remote.sexsexviet.com:8880
remote.sexsexviet.com:2052
remote.sexsexviet.com:2082
remote.sexsexviet.com:2086
remote.sexsexviet.com:2095
remote.sexsexviet.com:443
remote.sexsexviet.com:2053
remote.sexsexviet.com:2083
remote.sexsexviet.com:2087
remote.sexsexviet.com:2096
remote.sexsexviet.com:8443
darkside.sexsexviet.com:80
darkside.sexsexviet.com:22
darkside.sexsexviet.com:8080
darkside.sexsexviet.com:8880
darkside.sexsexviet.com:2052
darkside.sexsexviet.com:2082
darkside.sexsexviet.com:2086
darkside.sexsexviet.com:2095
darkside.sexsexviet.com:443
darkside.sexsexviet.com:2053
darkside.sexsexviet.com:2083
darkside.sexsexviet.com:2087
darkside.sexsexviet.com:2096
darkside.sexsexviet.com:8443
agenttesla.sexsexviet.com:80
agenttesla.sexsexviet.com:22
agenttesla.sexsexviet.com:8080
agenttesla.sexsexviet.com:8880
agenttesla.sexsexviet.com:2052
agenttesla.sexsexviet.com:2082
agenttesla.sexsexviet.com:2086
agenttesla.sexsexviet.com:2095
agenttesla.sexsexviet.com:443
agenttesla.sexsexviet.com:2053
agenttesla.sexsexviet.com:2083
agenttesla.sexsexviet.com:2087
agenttesla.sexsexviet.com:2096
agenttesla.sexsexviet.com:8443

Mutex

ABaLI3Nd1VxM

Attributes

delay
0
install
true
install_file
rs115.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  72bb5ffef3db426bdf99bb540d9f7a3a6a9b78d77c2d8b4db56b8ddb99610802
- Size 45KB
- SHA256 72bb5ffef3db426bdf99bb540d9f7a3a6a9b78d77c2d8b4db56b8ddb99610802
- MD5 e9e417c49932ef2405f6a1df74e301f2
- SHA1 b99a82617fea49d2dc836d0082e762ccf73ae852
- SHA512 006c3d501aa87c1ff7543553472d9eb4aa284df60b1aa2097d67f164e4f968043b8b5662d4c4ae1548d8eb9e15ab4f31b35500810cb64feef3eee6f759039e61
- SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ/ZTohEaSPIvzjbsgX3iJ0x21Nta4ikdwP6G5BDZUx:cuqb5TrhG2F4Ea7v3bjXSCxiNAFhiudW
- TLSH
  T13D231A003BE8822BF2BE4F789DF26245867EB6632603D5491CC451DB5713BC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2