asyncrat | cfd399fc9cf9b46b5c633c44475acdf85f014493bb9e215b2385742afe79c7b2

Sharing

Copy URL Twitter E-mail

General

Target
cfd399fc9cf9b46b5c633c44475acdf85f014493bb9e215b2385742afe79c7b2
Size 45KB
Sample260724-v8eb4shg37
SHA256 cfd399fc9cf9b46b5c633c44475acdf85f014493bb9e215b2385742afe79c7b2
MD5 21770133aa52ef6cb1ef3881ca2798d0
SHA1 aa1a7ef5f4a9efdb8e8a4e5777655ed9e91816dc
SHA512 de4d8681dc618904dd49158292e22352e1a73ebe74191022acd500fe0cbc4d43f395201ee74bd4b13393f537496fd06f581edf7ce6e5d54746efbc480f52b450
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qA+8kLyuObvtkjZPICzjbrgXwiv8BLm6MSvG7KBDZW:cuqNJTLr62u8LuyyjWC3bUXNUBK7S3dW
TLSH
T121232A0037E9812BF2BE4F78A8F26145867AF6636603D5491CC451DB5B13FC68A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

storage.haysexcdn.net:80
storage.haysexcdn.net:22
storage.haysexcdn.net:8080
storage.haysexcdn.net:8880
storage.haysexcdn.net:2052
storage.haysexcdn.net:2082
storage.haysexcdn.net:2086
storage.haysexcdn.net:2095
storage.haysexcdn.net:443
storage.haysexcdn.net:2053
storage.haysexcdn.net:2083
storage.haysexcdn.net:2087
storage.haysexcdn.net:2096
storage.haysexcdn.net:8443
www.storage.haysexcdn.net:80
www.storage.haysexcdn.net:22
www.storage.haysexcdn.net:8080
www.storage.haysexcdn.net:8880
www.storage.haysexcdn.net:2052
www.storage.haysexcdn.net:2082
www.storage.haysexcdn.net:2086
www.storage.haysexcdn.net:2095
www.storage.haysexcdn.net:443
www.storage.haysexcdn.net:2053
www.storage.haysexcdn.net:2083
www.storage.haysexcdn.net:2087
www.storage.haysexcdn.net:2096
www.storage.haysexcdn.net:8443
mydoom.storage.haysexcdn.net:80
mydoom.storage.haysexcdn.net:22
mydoom.storage.haysexcdn.net:8080
mydoom.storage.haysexcdn.net:8880
mydoom.storage.haysexcdn.net:2052
mydoom.storage.haysexcdn.net:2082
mydoom.storage.haysexcdn.net:2086
mydoom.storage.haysexcdn.net:2095
mydoom.storage.haysexcdn.net:443
mydoom.storage.haysexcdn.net:2053
mydoom.storage.haysexcdn.net:2083
mydoom.storage.haysexcdn.net:2087
mydoom.storage.haysexcdn.net:2096
mydoom.storage.haysexcdn.net:8443
malware.storage.haysexcdn.net:80
malware.storage.haysexcdn.net:22
malware.storage.haysexcdn.net:8080
malware.storage.haysexcdn.net:8880
malware.storage.haysexcdn.net:2052
malware.storage.haysexcdn.net:2082
malware.storage.haysexcdn.net:2086
malware.storage.haysexcdn.net:2095
malware.storage.haysexcdn.net:443
malware.storage.haysexcdn.net:2053
malware.storage.haysexcdn.net:2083
malware.storage.haysexcdn.net:2087
malware.storage.haysexcdn.net:2096
malware.storage.haysexcdn.net:8443
iloveyou.storage.haysexcdn.net:80
iloveyou.storage.haysexcdn.net:22
iloveyou.storage.haysexcdn.net:8080
iloveyou.storage.haysexcdn.net:8880
iloveyou.storage.haysexcdn.net:2052
iloveyou.storage.haysexcdn.net:2082
iloveyou.storage.haysexcdn.net:2086
iloveyou.storage.haysexcdn.net:2095
iloveyou.storage.haysexcdn.net:443
iloveyou.storage.haysexcdn.net:2053
iloveyou.storage.haysexcdn.net:2083
iloveyou.storage.haysexcdn.net:2087
iloveyou.storage.haysexcdn.net:2096
iloveyou.storage.haysexcdn.net:8443

Mutex

8rFfCgDc8mtr

Attributes

delay
0
install
true
install_file
pv5r.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  cfd399fc9cf9b46b5c633c44475acdf85f014493bb9e215b2385742afe79c7b2
- Size 45KB
- SHA256 cfd399fc9cf9b46b5c633c44475acdf85f014493bb9e215b2385742afe79c7b2
- MD5 21770133aa52ef6cb1ef3881ca2798d0
- SHA1 aa1a7ef5f4a9efdb8e8a4e5777655ed9e91816dc
- SHA512 de4d8681dc618904dd49158292e22352e1a73ebe74191022acd500fe0cbc4d43f395201ee74bd4b13393f537496fd06f581edf7ce6e5d54746efbc480f52b450
- SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qA+8kLyuObvtkjZPICzjbrgXwiv8BLm6MSvG7KBDZW:cuqNJTLr62u8LuyyjWC3bUXNUBK7S3dW
- TLSH
  T121232A0037E9812BF2BE4F78A8F26145867AF6636603D5491CC451DB5B13FC68A43AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2