asyncrat | 1aec0e83d08a1e184d433f21c962b885698f6590172a7b63f44e9272cde9b279

Sharing

Copy URL Twitter E-mail

General

Target
1aec0e83d08a1e184d433f21c962b885698f6590172a7b63f44e9272cde9b279
Size 45KB
Sample260804-hfxlrshn4w
SHA256 1aec0e83d08a1e184d433f21c962b885698f6590172a7b63f44e9272cde9b279
MD5 2011741e4cb15291858db5464badec04
SHA1 dfab2e81d0d9c90aca04645107319aa207d8cd10
SHA512 6804c1b959441686247d38dbbd22226b820fd7efd96c09bfb15fac0ba4bb2129a142262fd058d696b10ee2f76696b19b6db10c16dbec5fa89807c39f7fa705bb
SSDEEP 768:guKWgSJTwU6NkWUGnaSmo2qAsj0UwPOlehAPITpzjbwgX3icaqn3SBDZwx:guKWgSJTwRf28j0/OghlTp3b3XSLq3sY
TLSH
T10B233A003BE9812BF2BE4F78ADF26145467AF2637603D6491CC451DB5A23FC6CA426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hentaivietsub.com:80
hentaivietsub.com:22
hentaivietsub.com:8080
hentaivietsub.com:8880
hentaivietsub.com:2052
hentaivietsub.com:2082
hentaivietsub.com:2086
hentaivietsub.com:2095
hentaivietsub.com:443
hentaivietsub.com:2053
hentaivietsub.com:2083
hentaivietsub.com:2087
hentaivietsub.com:2096
hentaivietsub.com:8443
www.hentaivietsub.com:80
www.hentaivietsub.com:22
www.hentaivietsub.com:8080
www.hentaivietsub.com:8880
www.hentaivietsub.com:2052
www.hentaivietsub.com:2082
www.hentaivietsub.com:2086
www.hentaivietsub.com:2095
www.hentaivietsub.com:443
www.hentaivietsub.com:2053
www.hentaivietsub.com:2083
www.hentaivietsub.com:2087
www.hentaivietsub.com:2096
www.hentaivietsub.com:8443
fakeupdates.hentaivietsub.com:80
fakeupdates.hentaivietsub.com:22
fakeupdates.hentaivietsub.com:8080
fakeupdates.hentaivietsub.com:8880
fakeupdates.hentaivietsub.com:2052
fakeupdates.hentaivietsub.com:2082
fakeupdates.hentaivietsub.com:2086
fakeupdates.hentaivietsub.com:2095
fakeupdates.hentaivietsub.com:443
fakeupdates.hentaivietsub.com:2053
fakeupdates.hentaivietsub.com:2083
fakeupdates.hentaivietsub.com:2087
fakeupdates.hentaivietsub.com:2096
fakeupdates.hentaivietsub.com:8443
connect.hentaivietsub.com:80
connect.hentaivietsub.com:22
connect.hentaivietsub.com:8080
connect.hentaivietsub.com:8880
connect.hentaivietsub.com:2052
connect.hentaivietsub.com:2082
connect.hentaivietsub.com:2086
connect.hentaivietsub.com:2095
connect.hentaivietsub.com:443
connect.hentaivietsub.com:2053
connect.hentaivietsub.com:2083
connect.hentaivietsub.com:2087
connect.hentaivietsub.com:2096
connect.hentaivietsub.com:8443
nanocore.hentaivietsub.com:80
nanocore.hentaivietsub.com:22
nanocore.hentaivietsub.com:8080
nanocore.hentaivietsub.com:8880
nanocore.hentaivietsub.com:2052
nanocore.hentaivietsub.com:2082
nanocore.hentaivietsub.com:2086
nanocore.hentaivietsub.com:2095
nanocore.hentaivietsub.com:443
nanocore.hentaivietsub.com:2053
nanocore.hentaivietsub.com:2083
nanocore.hentaivietsub.com:2087
nanocore.hentaivietsub.com:2096
nanocore.hentaivietsub.com:8443

Mutex

LfmaOhtvfVLs

Attributes

delay
0
install
true
install_file
ux678mov.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1aec0e83d08a1e184d433f21c962b885698f6590172a7b63f44e9272cde9b279
- Size 45KB
- SHA256 1aec0e83d08a1e184d433f21c962b885698f6590172a7b63f44e9272cde9b279
- MD5 2011741e4cb15291858db5464badec04
- SHA1 dfab2e81d0d9c90aca04645107319aa207d8cd10
- SHA512 6804c1b959441686247d38dbbd22226b820fd7efd96c09bfb15fac0ba4bb2129a142262fd058d696b10ee2f76696b19b6db10c16dbec5fa89807c39f7fa705bb
- SSDEEP 768:guKWgSJTwU6NkWUGnaSmo2qAsj0UwPOlehAPITpzjbwgX3icaqn3SBDZwx:guKWgSJTwRf28j0/OghlTp3b3XSLq3sY
- TLSH
  T10B233A003BE9812BF2BE4F78ADF26145467AF2637603D6491CC451DB5A23FC6CA426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2