asyncrat | 62f31150673028f3bfd5c2b539225ad1239571e72c2c2d0d3c4dc15cef9459d9

Sharing

Copy URL Twitter E-mail

General

Target
62f31150673028f3bfd5c2b539225ad1239571e72c2c2d0d3c4dc15cef9459d9
Size 45KB
Sample260724-v8zcaavcma
SHA256 62f31150673028f3bfd5c2b539225ad1239571e72c2c2d0d3c4dc15cef9459d9
MD5 c6eeef8f50ac25407193aece2ac25cce
SHA1 28b4ea33f8aa352f4c84438cdc6e34529610fd0f
SHA512 56364c583541c22645564230942c4696030d19a4f81e8dee7e0e746330b447711bce064d7e923a109fed867b2141fc5c52b007337af6ff3e2ecd1e55fe0328ae
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1n+GtnVnJtHuPIWzjbKgX3ijillmi+IEBDZUx:cu6YepTPso2M++B3W3bdXSjAlmi+JdUx
TLSH
T17D232B003BE9812BF2BF4BB899F26145867EF1633603D6492CC451DB5723BC686426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexdamvn.com:80
sexdamvn.com:22
sexdamvn.com:8080
sexdamvn.com:8880
sexdamvn.com:2052
sexdamvn.com:2082
sexdamvn.com:2086
sexdamvn.com:2095
sexdamvn.com:443
sexdamvn.com:2053
sexdamvn.com:2083
sexdamvn.com:2087
sexdamvn.com:2096
sexdamvn.com:8443
www.sexdamvn.com:80
www.sexdamvn.com:22
www.sexdamvn.com:8080
www.sexdamvn.com:8880
www.sexdamvn.com:2052
www.sexdamvn.com:2082
www.sexdamvn.com:2086
www.sexdamvn.com:2095
www.sexdamvn.com:443
www.sexdamvn.com:2053
www.sexdamvn.com:2083
www.sexdamvn.com:2087
www.sexdamvn.com:2096
www.sexdamvn.com:8443
clop.sexdamvn.com:80
clop.sexdamvn.com:22
clop.sexdamvn.com:8080
clop.sexdamvn.com:8880
clop.sexdamvn.com:2052
clop.sexdamvn.com:2082
clop.sexdamvn.com:2086
clop.sexdamvn.com:2095
clop.sexdamvn.com:443
clop.sexdamvn.com:2053
clop.sexdamvn.com:2083
clop.sexdamvn.com:2087
clop.sexdamvn.com:2096
clop.sexdamvn.com:8443
connect.sexdamvn.com:80
connect.sexdamvn.com:22
connect.sexdamvn.com:8080
connect.sexdamvn.com:8880
connect.sexdamvn.com:2052
connect.sexdamvn.com:2082
connect.sexdamvn.com:2086
connect.sexdamvn.com:2095
connect.sexdamvn.com:443
connect.sexdamvn.com:2053
connect.sexdamvn.com:2083
connect.sexdamvn.com:2087
connect.sexdamvn.com:2096
connect.sexdamvn.com:8443
klez.sexdamvn.com:80
klez.sexdamvn.com:22
klez.sexdamvn.com:8080
klez.sexdamvn.com:8880
klez.sexdamvn.com:2052
klez.sexdamvn.com:2082
klez.sexdamvn.com:2086
klez.sexdamvn.com:2095
klez.sexdamvn.com:443
klez.sexdamvn.com:2053
klez.sexdamvn.com:2083
klez.sexdamvn.com:2087
klez.sexdamvn.com:2096
klez.sexdamvn.com:8443
malware.sexdamvn.com:80
malware.sexdamvn.com:22
malware.sexdamvn.com:8080
malware.sexdamvn.com:8880
malware.sexdamvn.com:2052
malware.sexdamvn.com:2082
malware.sexdamvn.com:2086
malware.sexdamvn.com:2095
malware.sexdamvn.com:443
malware.sexdamvn.com:2053
malware.sexdamvn.com:2083
malware.sexdamvn.com:2087
malware.sexdamvn.com:2096
malware.sexdamvn.com:8443

Mutex

Aj7CE4c5tyVa

Attributes

delay
0
install
true
install_file
plf1sn4f.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  62f31150673028f3bfd5c2b539225ad1239571e72c2c2d0d3c4dc15cef9459d9
- Size 45KB
- SHA256 62f31150673028f3bfd5c2b539225ad1239571e72c2c2d0d3c4dc15cef9459d9
- MD5 c6eeef8f50ac25407193aece2ac25cce
- SHA1 28b4ea33f8aa352f4c84438cdc6e34529610fd0f
- SHA512 56364c583541c22645564230942c4696030d19a4f81e8dee7e0e746330b447711bce064d7e923a109fed867b2141fc5c52b007337af6ff3e2ecd1e55fe0328ae
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1n+GtnVnJtHuPIWzjbKgX3ijillmi+IEBDZUx:cu6YepTPso2M++B3W3bdXSjAlmi+JdUx
- TLSH
  T17D232B003BE9812BF2BF4BB899F26145867EF1633603D6492CC451DB5723BC686426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2