asyncrat | 6dbb3f964e84dca63c7ec79b3800dea2c124033ea508f98452c0f98dcdb9ce6f

Sharing

Copy URL Twitter E-mail

General

Target
6dbb3f964e84dca63c7ec79b3800dea2c124033ea508f98452c0f98dcdb9ce6f
Size 45KB
Sample260721-ryw8dswta1
SHA256 6dbb3f964e84dca63c7ec79b3800dea2c124033ea508f98452c0f98dcdb9ce6f
MD5 3bd7e25aff8d1542d85cecfa5ad049a1
SHA1 b27cf8b6359d825e00ca67e8f6c166d3cdb28404
SHA512 6175a3a568de75485eeffd4245d78d60e5d1002c8b1aeb36a480e3412af6d4730a7368c399ed2102036236d3feeffefab828fbc86fbd698f427e2bfddab617dc
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YqPq3hOPIezjbsgX3il/XI8rvcR2H3BDZsx:EufspTf2g2Gaqq3e3bjXSl/XTDcgRdsx
TLSH
T18A232A003BE9C12BF2BF4F789DF26145867AB2633603D64A1CC451DB1613BC69A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexdeptv.com:80
sexdeptv.com:22
sexdeptv.com:8080
sexdeptv.com:8880
sexdeptv.com:2052
sexdeptv.com:2082
sexdeptv.com:2086
sexdeptv.com:2095
sexdeptv.com:443
sexdeptv.com:2053
sexdeptv.com:2083
sexdeptv.com:2087
sexdeptv.com:2096
sexdeptv.com:8443
www.sexdeptv.com:80
www.sexdeptv.com:22
www.sexdeptv.com:8080
www.sexdeptv.com:8880
www.sexdeptv.com:2052
www.sexdeptv.com:2082
www.sexdeptv.com:2086
www.sexdeptv.com:2095
www.sexdeptv.com:443
www.sexdeptv.com:2053
www.sexdeptv.com:2083
www.sexdeptv.com:2087
www.sexdeptv.com:2096
www.sexdeptv.com:8443
fakeupdates.sexdeptv.com:80
fakeupdates.sexdeptv.com:22
fakeupdates.sexdeptv.com:8080
fakeupdates.sexdeptv.com:8880
fakeupdates.sexdeptv.com:2052
fakeupdates.sexdeptv.com:2082
fakeupdates.sexdeptv.com:2086
fakeupdates.sexdeptv.com:2095
fakeupdates.sexdeptv.com:443
fakeupdates.sexdeptv.com:2053
fakeupdates.sexdeptv.com:2083
fakeupdates.sexdeptv.com:2087
fakeupdates.sexdeptv.com:2096
fakeupdates.sexdeptv.com:8443
sodinokibi.sexdeptv.com:80
sodinokibi.sexdeptv.com:22
sodinokibi.sexdeptv.com:8080
sodinokibi.sexdeptv.com:8880
sodinokibi.sexdeptv.com:2052
sodinokibi.sexdeptv.com:2082
sodinokibi.sexdeptv.com:2086
sodinokibi.sexdeptv.com:2095
sodinokibi.sexdeptv.com:443
sodinokibi.sexdeptv.com:2053
sodinokibi.sexdeptv.com:2083
sodinokibi.sexdeptv.com:2087
sodinokibi.sexdeptv.com:2096
sodinokibi.sexdeptv.com:8443
industroyer.sexdeptv.com:80
industroyer.sexdeptv.com:22
industroyer.sexdeptv.com:8080
industroyer.sexdeptv.com:8880
industroyer.sexdeptv.com:2052
industroyer.sexdeptv.com:2082
industroyer.sexdeptv.com:2086
industroyer.sexdeptv.com:2095
industroyer.sexdeptv.com:443
industroyer.sexdeptv.com:2053
industroyer.sexdeptv.com:2083
industroyer.sexdeptv.com:2087
industroyer.sexdeptv.com:2096
industroyer.sexdeptv.com:8443

Mutex

0VhvtkufWprn

Attributes

delay
0
install
true
install_file
3qfyn5f.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6dbb3f964e84dca63c7ec79b3800dea2c124033ea508f98452c0f98dcdb9ce6f
- Size 45KB
- SHA256 6dbb3f964e84dca63c7ec79b3800dea2c124033ea508f98452c0f98dcdb9ce6f
- MD5 3bd7e25aff8d1542d85cecfa5ad049a1
- SHA1 b27cf8b6359d825e00ca67e8f6c166d3cdb28404
- SHA512 6175a3a568de75485eeffd4245d78d60e5d1002c8b1aeb36a480e3412af6d4730a7368c399ed2102036236d3feeffefab828fbc86fbd698f427e2bfddab617dc
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YqPq3hOPIezjbsgX3il/XI8rvcR2H3BDZsx:EufspTf2g2Gaqq3e3bjXSl/XTDcgRdsx
- TLSH
  T18A232A003BE9C12BF2BF4F789DF26145867AB2633603D64A1CC451DB1613BC69A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2