asyncrat | c9d109bc3814fa7edd9859cfd8a7e1e2fa8556a4e860c51dea8bec27ae043ab5

Sharing

Copy URL Twitter E-mail

General

Target
c9d109bc3814fa7edd9859cfd8a7e1e2fa8556a4e860c51dea8bec27ae043ab5
Size 45KB
Sample260718-scpf4adz8p
SHA256 c9d109bc3814fa7edd9859cfd8a7e1e2fa8556a4e860c51dea8bec27ae043ab5
MD5 15aed54ddcef819ba2ab10ec8ac21222
SHA1 92f935009eaa4422a6e2b397752b5d557482806b
SHA512 c00b7afd51653f253e47f7c6ef700bb56632f7555ce119e55ebf1269e0270366d1a04a6fcfdc89c1ebafe7093063461ebff9703a4f71a158f77e1e21733eff96
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE02FjMdjYkkmPIBzjbjgX3i4YFURgxR8+XumAB0:cuR0JTPjY2SL9wQPB3b8XS4YuRcRxXue
TLSH
T1A7233B0037E8812BF2BE4B78ADF26145867AF5736603D64A1CC451DB5B13BC68A436FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexnga.store:80
sexnga.store:22
sexnga.store:8080
sexnga.store:8880
sexnga.store:2052
sexnga.store:2082
sexnga.store:2086
sexnga.store:2095
sexnga.store:443
sexnga.store:2053
sexnga.store:2083
sexnga.store:2087
sexnga.store:2096
sexnga.store:8443
www.sexnga.store:80
www.sexnga.store:22
www.sexnga.store:8080
www.sexnga.store:8880
www.sexnga.store:2052
www.sexnga.store:2082
www.sexnga.store:2086
www.sexnga.store:2095
www.sexnga.store:443
www.sexnga.store:2053
www.sexnga.store:2083
www.sexnga.store:2087
www.sexnga.store:2096
www.sexnga.store:8443
nimda.sexnga.store:80
nimda.sexnga.store:22
nimda.sexnga.store:8080
nimda.sexnga.store:8880
nimda.sexnga.store:2052
nimda.sexnga.store:2082
nimda.sexnga.store:2086
nimda.sexnga.store:2095
nimda.sexnga.store:443
nimda.sexnga.store:2053
nimda.sexnga.store:2083
nimda.sexnga.store:2087
nimda.sexnga.store:2096
nimda.sexnga.store:8443
shamoon.sexnga.store:80
shamoon.sexnga.store:22
shamoon.sexnga.store:8080
shamoon.sexnga.store:8880
shamoon.sexnga.store:2052
shamoon.sexnga.store:2082
shamoon.sexnga.store:2086
shamoon.sexnga.store:2095
shamoon.sexnga.store:443
shamoon.sexnga.store:2053
shamoon.sexnga.store:2083
shamoon.sexnga.store:2087
shamoon.sexnga.store:2096
shamoon.sexnga.store:8443
revil.sexnga.store:80
revil.sexnga.store:22
revil.sexnga.store:8080
revil.sexnga.store:8880
revil.sexnga.store:2052
revil.sexnga.store:2082
revil.sexnga.store:2086
revil.sexnga.store:2095
revil.sexnga.store:443
revil.sexnga.store:2053
revil.sexnga.store:2083
revil.sexnga.store:2087
revil.sexnga.store:2096
revil.sexnga.store:8443

Mutex

zk4IaclmM4Sg

Attributes

delay
0
install
true
install_file
skx5.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c9d109bc3814fa7edd9859cfd8a7e1e2fa8556a4e860c51dea8bec27ae043ab5
- Size 45KB
- SHA256 c9d109bc3814fa7edd9859cfd8a7e1e2fa8556a4e860c51dea8bec27ae043ab5
- MD5 15aed54ddcef819ba2ab10ec8ac21222
- SHA1 92f935009eaa4422a6e2b397752b5d557482806b
- SHA512 c00b7afd51653f253e47f7c6ef700bb56632f7555ce119e55ebf1269e0270366d1a04a6fcfdc89c1ebafe7093063461ebff9703a4f71a158f77e1e21733eff96
- SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE02FjMdjYkkmPIBzjbjgX3i4YFURgxR8+XumAB0:cuR0JTPjY2SL9wQPB3b8XS4YuRcRxXue
- TLSH
  T1A7233B0037E8812BF2BE4B78ADF26145867AF5736603D64A1CC451DB5B13BC68A436FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2