asyncrat | f0ef6c012be89844cd1ddbb49893bd1d05afd06e6ff0b04c1dbaf48ce25ec7a3

Sharing

Copy URL Twitter E-mail

General

Target
f0ef6c012be89844cd1ddbb49893bd1d05afd06e6ff0b04c1dbaf48ce25ec7a3
Size 45KB
Sample260718-tn8jsaft8p
SHA256 f0ef6c012be89844cd1ddbb49893bd1d05afd06e6ff0b04c1dbaf48ce25ec7a3
MD5 2d03d681aabd1f9003a97fe743fc5bf4
SHA1 fb2d2461edab98c557c6b17560efd64942a62560
SHA512 abce96e06ac09474d0cc87ed1171f30e5b81ee1dc4295ccc19c77572edcc524cb45bfb9da34a64030d4077f6adaecfdcfb4eeb36cc830cddd241bd3e0622e7af
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA8/D0CCMAR4np78PIcFjbGgX3iqeQbiz9bQggBDZMx:kuSOpTPOP2MTCzwBcNbZXS4bG1Z2dMx
TLSH
T1F0233B0037E9812BF2BE5F7859F26145867AF6732603D54A1C8051DB5B23FC68A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexsexviet.com:80
sexsexviet.com:22
sexsexviet.com:8080
sexsexviet.com:8880
sexsexviet.com:2052
sexsexviet.com:2082
sexsexviet.com:2086
sexsexviet.com:2095
sexsexviet.com:443
sexsexviet.com:2053
sexsexviet.com:2083
sexsexviet.com:2087
sexsexviet.com:2096
sexsexviet.com:8443
www.sexsexviet.com:80
www.sexsexviet.com:22
www.sexsexviet.com:8080
www.sexsexviet.com:8880
www.sexsexviet.com:2052
www.sexsexviet.com:2082
www.sexsexviet.com:2086
www.sexsexviet.com:2095
www.sexsexviet.com:443
www.sexsexviet.com:2053
www.sexsexviet.com:2083
www.sexsexviet.com:2087
www.sexsexviet.com:2096
www.sexsexviet.com:8443
iloveyou.sexsexviet.com:80
iloveyou.sexsexviet.com:22
iloveyou.sexsexviet.com:8080
iloveyou.sexsexviet.com:8880
iloveyou.sexsexviet.com:2052
iloveyou.sexsexviet.com:2082
iloveyou.sexsexviet.com:2086
iloveyou.sexsexviet.com:2095
iloveyou.sexsexviet.com:443
iloveyou.sexsexviet.com:2053
iloveyou.sexsexviet.com:2083
iloveyou.sexsexviet.com:2087
iloveyou.sexsexviet.com:2096
iloveyou.sexsexviet.com:8443
downadup.sexsexviet.com:80
downadup.sexsexviet.com:22
downadup.sexsexviet.com:8080
downadup.sexsexviet.com:8880
downadup.sexsexviet.com:2052
downadup.sexsexviet.com:2082
downadup.sexsexviet.com:2086
downadup.sexsexviet.com:2095
downadup.sexsexviet.com:443
downadup.sexsexviet.com:2053
downadup.sexsexviet.com:2083
downadup.sexsexviet.com:2087
downadup.sexsexviet.com:2096
downadup.sexsexviet.com:8443
gozi.sexsexviet.com:80
gozi.sexsexviet.com:22
gozi.sexsexviet.com:8080
gozi.sexsexviet.com:8880
gozi.sexsexviet.com:2052
gozi.sexsexviet.com:2082
gozi.sexsexviet.com:2086
gozi.sexsexviet.com:2095
gozi.sexsexviet.com:443
gozi.sexsexviet.com:2053
gozi.sexsexviet.com:2083
gozi.sexsexviet.com:2087
gozi.sexsexviet.com:2096
gozi.sexsexviet.com:8443
notpetya.sexsexviet.com:80
notpetya.sexsexviet.com:22
notpetya.sexsexviet.com:8080
notpetya.sexsexviet.com:8880
notpetya.sexsexviet.com:2052
notpetya.sexsexviet.com:2082
notpetya.sexsexviet.com:2086
notpetya.sexsexviet.com:2095
notpetya.sexsexviet.com:443
notpetya.sexsexviet.com:2053
notpetya.sexsexviet.com:2083
notpetya.sexsexviet.com:2087
notpetya.sexsexviet.com:2096
notpetya.sexsexviet.com:8443

Mutex

ZKR88JPmtEEh

Attributes

delay
0
install
true
install_file
5yhd.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  f0ef6c012be89844cd1ddbb49893bd1d05afd06e6ff0b04c1dbaf48ce25ec7a3
- Size 45KB
- SHA256 f0ef6c012be89844cd1ddbb49893bd1d05afd06e6ff0b04c1dbaf48ce25ec7a3
- MD5 2d03d681aabd1f9003a97fe743fc5bf4
- SHA1 fb2d2461edab98c557c6b17560efd64942a62560
- SHA512 abce96e06ac09474d0cc87ed1171f30e5b81ee1dc4295ccc19c77572edcc524cb45bfb9da34a64030d4077f6adaecfdcfb4eeb36cc830cddd241bd3e0622e7af
- SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA8/D0CCMAR4np78PIcFjbGgX3iqeQbiz9bQggBDZMx:kuSOpTPOP2MTCzwBcNbZXS4bG1Z2dMx
- TLSH
  T1F0233B0037E9812BF2BE5F7859F26145867AF6732603D54A1C8051DB5B23FC68A43AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2