asyncrat | c9bf92460b46f819835d428fa36b5cca42a83d1d76eec3c4650253212d93ca0a

Sharing

Copy URL Twitter E-mail

General

Target
c9bf92460b46f819835d428fa36b5cca42a83d1d76eec3c4650253212d93ca0a
Size 45KB
Sample260718-rsdh4adv3j
SHA256 c9bf92460b46f819835d428fa36b5cca42a83d1d76eec3c4650253212d93ca0a
MD5 0abcf931f05257c34b2745120dd638c8
SHA1 9030749a439faeb4cfb42734511e36887a511dc1
SHA512 d1d03259b2a930539935079313928a188c0fa4f2b2c669b5f3a2d38028df31a6076a7b212017786f9f4899e3a8db6d2d9d7d2489bd071b5ee4f073b19bdc4f0c
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVcqyE0OFUwdexIkDPI4zjb7gX3i/Y1+0soApp6rj+w:MuBGJTPho2tqNTwM43bEXS/SD6GMSbVB
TLSH
T10B231A0037E9812BF2BE4F74A9F26145467AF6733603D98E1C8451DB5623FC68A43AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexsexviet.com:80
sexsexviet.com:22
sexsexviet.com:8080
sexsexviet.com:8880
sexsexviet.com:2052
sexsexviet.com:2082
sexsexviet.com:2086
sexsexviet.com:2095
sexsexviet.com:443
sexsexviet.com:2053
sexsexviet.com:2083
sexsexviet.com:2087
sexsexviet.com:2096
sexsexviet.com:8443
www.sexsexviet.com:80
www.sexsexviet.com:22
www.sexsexviet.com:8080
www.sexsexviet.com:8880
www.sexsexviet.com:2052
www.sexsexviet.com:2082
www.sexsexviet.com:2086
www.sexsexviet.com:2095
www.sexsexviet.com:443
www.sexsexviet.com:2053
www.sexsexviet.com:2083
www.sexsexviet.com:2087
www.sexsexviet.com:2096
www.sexsexviet.com:8443
ryuk.sexsexviet.com:80
ryuk.sexsexviet.com:22
ryuk.sexsexviet.com:8080
ryuk.sexsexviet.com:8880
ryuk.sexsexviet.com:2052
ryuk.sexsexviet.com:2082
ryuk.sexsexviet.com:2086
ryuk.sexsexviet.com:2095
ryuk.sexsexviet.com:443
ryuk.sexsexviet.com:2053
ryuk.sexsexviet.com:2083
ryuk.sexsexviet.com:2087
ryuk.sexsexviet.com:2096
ryuk.sexsexviet.com:8443
ursnif.sexsexviet.com:80
ursnif.sexsexviet.com:22
ursnif.sexsexviet.com:8080
ursnif.sexsexviet.com:8880
ursnif.sexsexviet.com:2052
ursnif.sexsexviet.com:2082
ursnif.sexsexviet.com:2086
ursnif.sexsexviet.com:2095
ursnif.sexsexviet.com:443
ursnif.sexsexviet.com:2053
ursnif.sexsexviet.com:2083
ursnif.sexsexviet.com:2087
ursnif.sexsexviet.com:2096
ursnif.sexsexviet.com:8443
industroyer.sexsexviet.com:80
industroyer.sexsexviet.com:22
industroyer.sexsexviet.com:8080
industroyer.sexsexviet.com:8880
industroyer.sexsexviet.com:2052
industroyer.sexsexviet.com:2082
industroyer.sexsexviet.com:2086
industroyer.sexsexviet.com:2095
industroyer.sexsexviet.com:443
industroyer.sexsexviet.com:2053
industroyer.sexsexviet.com:2083
industroyer.sexsexviet.com:2087
industroyer.sexsexviet.com:2096
industroyer.sexsexviet.com:8443

Mutex

jrlHQopIrCQ9

Attributes

delay
0
install
true
install_file
9mp1.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c9bf92460b46f819835d428fa36b5cca42a83d1d76eec3c4650253212d93ca0a
- Size 45KB
- SHA256 c9bf92460b46f819835d428fa36b5cca42a83d1d76eec3c4650253212d93ca0a
- MD5 0abcf931f05257c34b2745120dd638c8
- SHA1 9030749a439faeb4cfb42734511e36887a511dc1
- SHA512 d1d03259b2a930539935079313928a188c0fa4f2b2c669b5f3a2d38028df31a6076a7b212017786f9f4899e3a8db6d2d9d7d2489bd071b5ee4f073b19bdc4f0c
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVcqyE0OFUwdexIkDPI4zjb7gX3i/Y1+0soApp6rj+w:MuBGJTPho2tqNTwM43bEXS/SD6GMSbVB
- TLSH
  T10B231A0037E9812BF2BE4F74A9F26145467AF6733603D98E1C8451DB5623FC68A43AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2