asyncrat | d5a13342dc8805eed2c113433cf40075a5fcd0939d5bef6ec6fb8be260ac81c1

Sharing

Copy URL Twitter E-mail

General

Target
d5a13342dc8805eed2c113433cf40075a5fcd0939d5bef6ec6fb8be260ac81c1
Size 45KB
Sample260718-vhdb5abv7y
SHA256 d5a13342dc8805eed2c113433cf40075a5fcd0939d5bef6ec6fb8be260ac81c1
MD5 147b00ed59dfa6e87ea9fcb4e2b40327
SHA1 2dc490e3cf3cfb35484bd4784b5a249790cc6ade
SHA512 cc181577cb38c4bb03605bddf4656544e2f5d4528e432ab147800f8b66987c7edb36e2fe1513f6f87c6c8167469d98737fad9c08aafee1c8e661192f41f69723
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9yiaLzwJAOPIcFzjbsgXLi0k3XqyDw4gBBDZsx:EulCJTHl42l5U23cF3bjXGydN/dsx
TLSH
T11B232A003BE8C12BF2BE4F74A9F26145867EF6633603D59E1CC4529B4613FC699426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexjav.cfd:80
sexjav.cfd:22
sexjav.cfd:8080
sexjav.cfd:8880
sexjav.cfd:2052
sexjav.cfd:2082
sexjav.cfd:2086
sexjav.cfd:2095
sexjav.cfd:443
sexjav.cfd:2053
sexjav.cfd:2083
sexjav.cfd:2087
sexjav.cfd:2096
sexjav.cfd:8443
www.sexjav.cfd:80
www.sexjav.cfd:22
www.sexjav.cfd:8080
www.sexjav.cfd:8880
www.sexjav.cfd:2052
www.sexjav.cfd:2082
www.sexjav.cfd:2086
www.sexjav.cfd:2095
www.sexjav.cfd:443
www.sexjav.cfd:2053
www.sexjav.cfd:2083
www.sexjav.cfd:2087
www.sexjav.cfd:2096
www.sexjav.cfd:8443
socgholish.sexjav.cfd:80
socgholish.sexjav.cfd:22
socgholish.sexjav.cfd:8080
socgholish.sexjav.cfd:8880
socgholish.sexjav.cfd:2052
socgholish.sexjav.cfd:2082
socgholish.sexjav.cfd:2086
socgholish.sexjav.cfd:2095
socgholish.sexjav.cfd:443
socgholish.sexjav.cfd:2053
socgholish.sexjav.cfd:2083
socgholish.sexjav.cfd:2087
socgholish.sexjav.cfd:2096
socgholish.sexjav.cfd:8443
trickbot.sexjav.cfd:80
trickbot.sexjav.cfd:22
trickbot.sexjav.cfd:8080
trickbot.sexjav.cfd:8880
trickbot.sexjav.cfd:2052
trickbot.sexjav.cfd:2082
trickbot.sexjav.cfd:2086
trickbot.sexjav.cfd:2095
trickbot.sexjav.cfd:443
trickbot.sexjav.cfd:2053
trickbot.sexjav.cfd:2083
trickbot.sexjav.cfd:2087
trickbot.sexjav.cfd:2096
trickbot.sexjav.cfd:8443
qakbot.sexjav.cfd:80
qakbot.sexjav.cfd:22
qakbot.sexjav.cfd:8080
qakbot.sexjav.cfd:8880
qakbot.sexjav.cfd:2052
qakbot.sexjav.cfd:2082
qakbot.sexjav.cfd:2086
qakbot.sexjav.cfd:2095
qakbot.sexjav.cfd:443
qakbot.sexjav.cfd:2053
qakbot.sexjav.cfd:2083
qakbot.sexjav.cfd:2087
qakbot.sexjav.cfd:2096
qakbot.sexjav.cfd:8443
sasser.sexjav.cfd:80
sasser.sexjav.cfd:22
sasser.sexjav.cfd:8080
sasser.sexjav.cfd:8880
sasser.sexjav.cfd:2052
sasser.sexjav.cfd:2082
sasser.sexjav.cfd:2086
sasser.sexjav.cfd:2095
sasser.sexjav.cfd:443
sasser.sexjav.cfd:2053
sasser.sexjav.cfd:2083
sasser.sexjav.cfd:2087
sasser.sexjav.cfd:2096
sasser.sexjav.cfd:8443

Mutex

DDuUcukV11GF

Attributes

delay
0
install
true
install_file
2ocdzn.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  d5a13342dc8805eed2c113433cf40075a5fcd0939d5bef6ec6fb8be260ac81c1
- Size 45KB
- SHA256 d5a13342dc8805eed2c113433cf40075a5fcd0939d5bef6ec6fb8be260ac81c1
- MD5 147b00ed59dfa6e87ea9fcb4e2b40327
- SHA1 2dc490e3cf3cfb35484bd4784b5a249790cc6ade
- SHA512 cc181577cb38c4bb03605bddf4656544e2f5d4528e432ab147800f8b66987c7edb36e2fe1513f6f87c6c8167469d98737fad9c08aafee1c8e661192f41f69723
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9yiaLzwJAOPIcFzjbsgXLi0k3XqyDw4gBBDZsx:EulCJTHl42l5U23cF3bjXGydN/dsx
- TLSH
  T11B232A003BE8C12BF2BE4F74A9F26145867EF6633603D59E1CC4529B4613FC699426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2