asyncrat | 27ee35a74c58b80f084468f390940f6939930fa296d4979716f3c2656c341d0b

Sharing

Copy URL Twitter E-mail

General

Target
27ee35a74c58b80f084468f390940f6939930fa296d4979716f3c2656c341d0b
Size 45KB
Sample260720-rx3c1sds9p
SHA256 27ee35a74c58b80f084468f390940f6939930fa296d4979716f3c2656c341d0b
MD5 1c64b6c09dc013888b20d5664e86778c
SHA1 3e2bc8c4adeb5b8f6aa520c6cef0b3fc14546160
SHA512 111bf1c6dcf4fa47a0626094621fff0917f7ce9241cd01d485e3ac588c06768e7eef44f3b9b7a024e63b94fbcf22b00ff6adc7035822836ec6800357495983b6
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHBl3040WMOPI0hzjbVgXoibPTerK0YyQT0vBDZEx:MuLAZTnbg20eUM30h3byXlBcQTKdEx
TLSH
T14F232B003BE8812BF2BE5FB8A8F26145857EF6736603D54A1CC451DB4613BC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mayhitgoin:80
mayhitgoin:22
mayhitgoin:8080
mayhitgoin:8880
mayhitgoin:2052
mayhitgoin:2082
mayhitgoin:2086
mayhitgoin:2095
mayhitgoin:443
mayhitgoin:2053
mayhitgoin:2083
mayhitgoin:2087
mayhitgoin:2096
mayhitgoin:8443
www.mayhitgoin:80
www.mayhitgoin:22
www.mayhitgoin:8080
www.mayhitgoin:8880
www.mayhitgoin:2052
www.mayhitgoin:2082
www.mayhitgoin:2086
www.mayhitgoin:2095
www.mayhitgoin:443
www.mayhitgoin:2053
www.mayhitgoin:2083
www.mayhitgoin:2087
www.mayhitgoin:2096
www.mayhitgoin:8443
socgholish.mayhitgoin:80
socgholish.mayhitgoin:22
socgholish.mayhitgoin:8080
socgholish.mayhitgoin:8880
socgholish.mayhitgoin:2052
socgholish.mayhitgoin:2082
socgholish.mayhitgoin:2086
socgholish.mayhitgoin:2095
socgholish.mayhitgoin:443
socgholish.mayhitgoin:2053
socgholish.mayhitgoin:2083
socgholish.mayhitgoin:2087
socgholish.mayhitgoin:2096
socgholish.mayhitgoin:8443
sodinokibi.mayhitgoin:80
sodinokibi.mayhitgoin:22
sodinokibi.mayhitgoin:8080
sodinokibi.mayhitgoin:8880
sodinokibi.mayhitgoin:2052
sodinokibi.mayhitgoin:2082
sodinokibi.mayhitgoin:2086
sodinokibi.mayhitgoin:2095
sodinokibi.mayhitgoin:443
sodinokibi.mayhitgoin:2053
sodinokibi.mayhitgoin:2083
sodinokibi.mayhitgoin:2087
sodinokibi.mayhitgoin:2096
sodinokibi.mayhitgoin:8443
ryuk.mayhitgoin:80
ryuk.mayhitgoin:22
ryuk.mayhitgoin:8080
ryuk.mayhitgoin:8880
ryuk.mayhitgoin:2052
ryuk.mayhitgoin:2082
ryuk.mayhitgoin:2086
ryuk.mayhitgoin:2095
ryuk.mayhitgoin:443
ryuk.mayhitgoin:2053
ryuk.mayhitgoin:2083
ryuk.mayhitgoin:2087
ryuk.mayhitgoin:2096
ryuk.mayhitgoin:8443
nanocore.mayhitgoin:80
nanocore.mayhitgoin:22
nanocore.mayhitgoin:8080
nanocore.mayhitgoin:8880
nanocore.mayhitgoin:2052
nanocore.mayhitgoin:2082
nanocore.mayhitgoin:2086
nanocore.mayhitgoin:2095
nanocore.mayhitgoin:443
nanocore.mayhitgoin:2053
nanocore.mayhitgoin:2083
nanocore.mayhitgoin:2087
nanocore.mayhitgoin:2096
nanocore.mayhitgoin:8443

Mutex

hF7cgti9yAj0

Attributes

delay
0
install
true
install_file
n6udp.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  27ee35a74c58b80f084468f390940f6939930fa296d4979716f3c2656c341d0b
- Size 45KB
- SHA256 27ee35a74c58b80f084468f390940f6939930fa296d4979716f3c2656c341d0b
- MD5 1c64b6c09dc013888b20d5664e86778c
- SHA1 3e2bc8c4adeb5b8f6aa520c6cef0b3fc14546160
- SHA512 111bf1c6dcf4fa47a0626094621fff0917f7ce9241cd01d485e3ac588c06768e7eef44f3b9b7a024e63b94fbcf22b00ff6adc7035822836ec6800357495983b6
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHBl3040WMOPI0hzjbVgXoibPTerK0YyQT0vBDZEx:MuLAZTnbg20eUM30h3byXlBcQTKdEx
- TLSH
  T14F232B003BE8812BF2BE5FB8A8F26145857EF6736603D54A1CC451DB4613BC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2