asyncrat | c928a52694f063bfb4671129974249e9d11afd4b49a6908492300e6eb75aeee2

Sharing

Copy URL Twitter E-mail

General

Target
c928a52694f063bfb4671129974249e9d11afd4b49a6908492300e6eb75aeee2
Size 45KB
Sample260721-w5pt4ssfjf
SHA256 c928a52694f063bfb4671129974249e9d11afd4b49a6908492300e6eb75aeee2
MD5 5ce5276aa4f471751839b3ad9ef16166
SHA1 74f135e16cbe0e4d062628808e397d7ef676a864
SHA512 dab77cea3aaa980ef3f2756607e3d1f51a2e9a664c46f554a39a0334635348bf9a3710e37f175d2109ebc363d4b2fbeacdfdfcf8cd290fb81015164006c9b44b
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9hCHyTtpPI3zjbOgX3iMMCsHPqgm88DiOcJF2BDZsx:EulCJTHl422nQ33bxXSOsHPDmmJ6dsx
TLSH
T17F232A0037E8812BF2BE4FB8A9F25145467AF5673A03D58E2CC441DB5723FC696426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexdeptv.com:80
sexdeptv.com:22
sexdeptv.com:8080
sexdeptv.com:8880
sexdeptv.com:2052
sexdeptv.com:2082
sexdeptv.com:2086
sexdeptv.com:2095
sexdeptv.com:443
sexdeptv.com:2053
sexdeptv.com:2083
sexdeptv.com:2087
sexdeptv.com:2096
sexdeptv.com:8443
www.sexdeptv.com:80
www.sexdeptv.com:22
www.sexdeptv.com:8080
www.sexdeptv.com:8880
www.sexdeptv.com:2052
www.sexdeptv.com:2082
www.sexdeptv.com:2086
www.sexdeptv.com:2095
www.sexdeptv.com:443
www.sexdeptv.com:2053
www.sexdeptv.com:2083
www.sexdeptv.com:2087
www.sexdeptv.com:2096
www.sexdeptv.com:8443
gozi.sexdeptv.com:80
gozi.sexdeptv.com:22
gozi.sexdeptv.com:8080
gozi.sexdeptv.com:8880
gozi.sexdeptv.com:2052
gozi.sexdeptv.com:2082
gozi.sexdeptv.com:2086
gozi.sexdeptv.com:2095
gozi.sexdeptv.com:443
gozi.sexdeptv.com:2053
gozi.sexdeptv.com:2083
gozi.sexdeptv.com:2087
gozi.sexdeptv.com:2096
gozi.sexdeptv.com:8443
zbot.sexdeptv.com:80
zbot.sexdeptv.com:22
zbot.sexdeptv.com:8080
zbot.sexdeptv.com:8880
zbot.sexdeptv.com:2052
zbot.sexdeptv.com:2082
zbot.sexdeptv.com:2086
zbot.sexdeptv.com:2095
zbot.sexdeptv.com:443
zbot.sexdeptv.com:2053
zbot.sexdeptv.com:2083
zbot.sexdeptv.com:2087
zbot.sexdeptv.com:2096
zbot.sexdeptv.com:8443
industroyer.sexdeptv.com:80
industroyer.sexdeptv.com:22
industroyer.sexdeptv.com:8080
industroyer.sexdeptv.com:8880
industroyer.sexdeptv.com:2052
industroyer.sexdeptv.com:2082
industroyer.sexdeptv.com:2086
industroyer.sexdeptv.com:2095
industroyer.sexdeptv.com:443
industroyer.sexdeptv.com:2053
industroyer.sexdeptv.com:2083
industroyer.sexdeptv.com:2087
industroyer.sexdeptv.com:2096
industroyer.sexdeptv.com:8443
zeus.sexdeptv.com:80
zeus.sexdeptv.com:22
zeus.sexdeptv.com:8080
zeus.sexdeptv.com:8880
zeus.sexdeptv.com:2052
zeus.sexdeptv.com:2082
zeus.sexdeptv.com:2086
zeus.sexdeptv.com:2095
zeus.sexdeptv.com:443
zeus.sexdeptv.com:2053
zeus.sexdeptv.com:2083
zeus.sexdeptv.com:2087
zeus.sexdeptv.com:2096
zeus.sexdeptv.com:8443

Mutex

a1LNHfCBLjrP

Attributes

delay
0
install
true
install_file
1m81i2.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c928a52694f063bfb4671129974249e9d11afd4b49a6908492300e6eb75aeee2
- Size 45KB
- SHA256 c928a52694f063bfb4671129974249e9d11afd4b49a6908492300e6eb75aeee2
- MD5 5ce5276aa4f471751839b3ad9ef16166
- SHA1 74f135e16cbe0e4d062628808e397d7ef676a864
- SHA512 dab77cea3aaa980ef3f2756607e3d1f51a2e9a664c46f554a39a0334635348bf9a3710e37f175d2109ebc363d4b2fbeacdfdfcf8cd290fb81015164006c9b44b
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9hCHyTtpPI3zjbOgX3iMMCsHPqgm88DiOcJF2BDZsx:EulCJTHl422nQ33bxXSOsHPDmmJ6dsx
- TLSH
  T17F232A0037E8812BF2BE4FB8A9F25145467AF5673A03D58E2CC441DB5723FC696426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2