asyncrat | 57539fa25450642550a18f508acd7087694ac5315daf3e624f3b67afc71d1b3e

Sharing

Copy URL Twitter E-mail

General

Target
57539fa25450642550a18f508acd7087694ac5315daf3e624f3b67afc71d1b3e
Size 45KB
Sample260724-vxjgpahf85
SHA256 57539fa25450642550a18f508acd7087694ac5315daf3e624f3b67afc71d1b3e
MD5 011e8eda76624847cc696221cefa94b3
SHA1 0e5b8cab8746a20c5bc7b52c2eee1e755851eff3
SHA512 b2e80c83684c9235e260c920e20f727d7963d327777cbf84d7d60ca66603c112e8fba5ee9a4e28ac5cbdc269105ea79f1bacf15aff6de1c61dadc4aec0334514
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAQBz3QKx7PIQyjbVgX3i4rYJUp9+BDZcx:UuKWgSJTwRf2gV0QebyXS4cJQQdcx
TLSH
T13D232B003BD8C12BF2BE4BB8A9F26145867AF6633603D54D2CC451D75623FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexdamvn.com:80
sexdamvn.com:22
sexdamvn.com:8080
sexdamvn.com:8880
sexdamvn.com:2052
sexdamvn.com:2082
sexdamvn.com:2086
sexdamvn.com:2095
sexdamvn.com:443
sexdamvn.com:2053
sexdamvn.com:2083
sexdamvn.com:2087
sexdamvn.com:2096
sexdamvn.com:8443
www.sexdamvn.com:80
www.sexdamvn.com:22
www.sexdamvn.com:8080
www.sexdamvn.com:8880
www.sexdamvn.com:2052
www.sexdamvn.com:2082
www.sexdamvn.com:2086
www.sexdamvn.com:2095
www.sexdamvn.com:443
www.sexdamvn.com:2053
www.sexdamvn.com:2083
www.sexdamvn.com:2087
www.sexdamvn.com:2096
www.sexdamvn.com:8443
nanocore.sexdamvn.com:80
nanocore.sexdamvn.com:22
nanocore.sexdamvn.com:8080
nanocore.sexdamvn.com:8880
nanocore.sexdamvn.com:2052
nanocore.sexdamvn.com:2082
nanocore.sexdamvn.com:2086
nanocore.sexdamvn.com:2095
nanocore.sexdamvn.com:443
nanocore.sexdamvn.com:2053
nanocore.sexdamvn.com:2083
nanocore.sexdamvn.com:2087
nanocore.sexdamvn.com:2096
nanocore.sexdamvn.com:8443
cryptolocker.sexdamvn.com:80
cryptolocker.sexdamvn.com:22
cryptolocker.sexdamvn.com:8080
cryptolocker.sexdamvn.com:8880
cryptolocker.sexdamvn.com:2052
cryptolocker.sexdamvn.com:2082
cryptolocker.sexdamvn.com:2086
cryptolocker.sexdamvn.com:2095
cryptolocker.sexdamvn.com:443
cryptolocker.sexdamvn.com:2053
cryptolocker.sexdamvn.com:2083
cryptolocker.sexdamvn.com:2087
cryptolocker.sexdamvn.com:2096
cryptolocker.sexdamvn.com:8443
dridex.sexdamvn.com:80
dridex.sexdamvn.com:22
dridex.sexdamvn.com:8080
dridex.sexdamvn.com:8880
dridex.sexdamvn.com:2052
dridex.sexdamvn.com:2082
dridex.sexdamvn.com:2086
dridex.sexdamvn.com:2095
dridex.sexdamvn.com:443
dridex.sexdamvn.com:2053
dridex.sexdamvn.com:2083
dridex.sexdamvn.com:2087
dridex.sexdamvn.com:2096
dridex.sexdamvn.com:8443
nimda.sexdamvn.com:80
nimda.sexdamvn.com:22
nimda.sexdamvn.com:8080
nimda.sexdamvn.com:8880
nimda.sexdamvn.com:2052
nimda.sexdamvn.com:2082
nimda.sexdamvn.com:2086
nimda.sexdamvn.com:2095
nimda.sexdamvn.com:443
nimda.sexdamvn.com:2053
nimda.sexdamvn.com:2083
nimda.sexdamvn.com:2087
nimda.sexdamvn.com:2096
nimda.sexdamvn.com:8443

Mutex

q3n5tnngRil9

Attributes

delay
0
install
true
install_file
dr3nu9ya.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  57539fa25450642550a18f508acd7087694ac5315daf3e624f3b67afc71d1b3e
- Size 45KB
- SHA256 57539fa25450642550a18f508acd7087694ac5315daf3e624f3b67afc71d1b3e
- MD5 011e8eda76624847cc696221cefa94b3
- SHA1 0e5b8cab8746a20c5bc7b52c2eee1e755851eff3
- SHA512 b2e80c83684c9235e260c920e20f727d7963d327777cbf84d7d60ca66603c112e8fba5ee9a4e28ac5cbdc269105ea79f1bacf15aff6de1c61dadc4aec0334514
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAQBz3QKx7PIQyjbVgX3i4rYJUp9+BDZcx:UuKWgSJTwRf2gV0QebyXS4cJQQdcx
- TLSH
  T13D232B003BD8C12BF2BE4BB8A9F26145867AF6633603D54D2CC451D75623FC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2