asyncrat | f4baafb2e0e928e5c9b4ea362480abce7904d4fba17d4bf92f88022e7eabf214

Sharing

Copy URL Twitter E-mail

General

Target
f4baafb2e0e928e5c9b4ea362480abce7904d4fba17d4bf92f88022e7eabf214
Size 45KB
Sample260722-n8rtwaee64
SHA256 f4baafb2e0e928e5c9b4ea362480abce7904d4fba17d4bf92f88022e7eabf214
MD5 a3afff3e2fee71d236d62981a8b69e14
SHA1 4b323877185cfe3852678b064d5137206037096d
SHA512 4dde78cc225a04233d24f71e60250c8b1a1b5348314f2bcf15fc06b19e38766e037cd496749b771500360a01c3a827d21e65046020a4421b74a9ab900c2ffc83
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVufkLyuObvtkjZPIuzjbhgX8iGD7OVRyl9TTWPBDZG:MuBGJTPho2HfLuyyjWu3bOX5G/l9HW5E
TLSH
T12B232A003BE9812BF2BE4F7899F26245867AF6632603D54D1CC451DB5613FC6CA42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sex18.tech:80
sex18.tech:22
sex18.tech:8080
sex18.tech:8880
sex18.tech:2052
sex18.tech:2082
sex18.tech:2086
sex18.tech:2095
sex18.tech:443
sex18.tech:2053
sex18.tech:2083
sex18.tech:2087
sex18.tech:2096
sex18.tech:8443
www.sex18.tech:80
www.sex18.tech:22
www.sex18.tech:8080
www.sex18.tech:8880
www.sex18.tech:2052
www.sex18.tech:2082
www.sex18.tech:2086
www.sex18.tech:2095
www.sex18.tech:443
www.sex18.tech:2053
www.sex18.tech:2083
www.sex18.tech:2087
www.sex18.tech:2096
www.sex18.tech:8443
notpetya.sex18.tech:80
notpetya.sex18.tech:22
notpetya.sex18.tech:8080
notpetya.sex18.tech:8880
notpetya.sex18.tech:2052
notpetya.sex18.tech:2082
notpetya.sex18.tech:2086
notpetya.sex18.tech:2095
notpetya.sex18.tech:443
notpetya.sex18.tech:2053
notpetya.sex18.tech:2083
notpetya.sex18.tech:2087
notpetya.sex18.tech:2096
notpetya.sex18.tech:8443
trisis.sex18.tech:80
trisis.sex18.tech:22
trisis.sex18.tech:8080
trisis.sex18.tech:8880
trisis.sex18.tech:2052
trisis.sex18.tech:2082
trisis.sex18.tech:2086
trisis.sex18.tech:2095
trisis.sex18.tech:443
trisis.sex18.tech:2053
trisis.sex18.tech:2083
trisis.sex18.tech:2087
trisis.sex18.tech:2096
trisis.sex18.tech:8443
gootloader.sex18.tech:80
gootloader.sex18.tech:22
gootloader.sex18.tech:8080
gootloader.sex18.tech:8880
gootloader.sex18.tech:2052
gootloader.sex18.tech:2082
gootloader.sex18.tech:2086
gootloader.sex18.tech:2095
gootloader.sex18.tech:443
gootloader.sex18.tech:2053
gootloader.sex18.tech:2083
gootloader.sex18.tech:2087
gootloader.sex18.tech:2096
gootloader.sex18.tech:8443
hacker.sex18.tech:80
hacker.sex18.tech:22
hacker.sex18.tech:8080
hacker.sex18.tech:8880
hacker.sex18.tech:2052
hacker.sex18.tech:2082
hacker.sex18.tech:2086
hacker.sex18.tech:2095
hacker.sex18.tech:443
hacker.sex18.tech:2053
hacker.sex18.tech:2083
hacker.sex18.tech:2087
hacker.sex18.tech:2096
hacker.sex18.tech:8443

Mutex

0QYWdcumvGVT

Attributes

delay
0
install
true
install_file
33fq.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  f4baafb2e0e928e5c9b4ea362480abce7904d4fba17d4bf92f88022e7eabf214
- Size 45KB
- SHA256 f4baafb2e0e928e5c9b4ea362480abce7904d4fba17d4bf92f88022e7eabf214
- MD5 a3afff3e2fee71d236d62981a8b69e14
- SHA1 4b323877185cfe3852678b064d5137206037096d
- SHA512 4dde78cc225a04233d24f71e60250c8b1a1b5348314f2bcf15fc06b19e38766e037cd496749b771500360a01c3a827d21e65046020a4421b74a9ab900c2ffc83
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVufkLyuObvtkjZPIuzjbhgX8iGD7OVRyl9TTWPBDZG:MuBGJTPho2HfLuyyjWu3bOX5G/l9HW5E
- TLSH
  T12B232A003BE9812BF2BE4F7899F26245867AF6632603D54D1CC451DB5613FC6CA42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2