asyncrat | 303fc34c19a845d805e0c94e928f9bd0740671b2c251c56530e22f62d870c833

Sharing

Copy URL Twitter E-mail

General

Target
303fc34c19a845d805e0c94e928f9bd0740671b2c251c56530e22f62d870c833
Size 45KB
Sample260804-vfw2fsdh42
SHA256 303fc34c19a845d805e0c94e928f9bd0740671b2c251c56530e22f62d870c833
MD5 f9c59729d532386cfb104939b6db4c85
SHA1 8bb47b25ece8667f8f51c0954575f291a6552f21
SHA512 dddcc7b9dcaf11c67130a20c9c92ced6b9afdd4703cf06fa6c88f292dc9e93d2194e388feff0e58c8e13e91f3e1d34fa14b8ce9da97ec378163ffcceff96b4f6
SSDEEP 768:EulCJTHESwgWUK3aGmo2q95dR3aI6OPIuzjbtg63i8xi8OY61XEcgf4Zm33ATvBc:EulCJTHl42mjqb3u3b66S8xlOYoXEcgL
TLSH
T111231B0037E8C12BF2BE4F7899F26145467EF6673603D68E1C8451DB5613FC68A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vnsextop1.com:80
vnsextop1.com:22
vnsextop1.com:8080
vnsextop1.com:8880
vnsextop1.com:2052
vnsextop1.com:2082
vnsextop1.com:2086
vnsextop1.com:2095
vnsextop1.com:443
vnsextop1.com:2053
vnsextop1.com:2083
vnsextop1.com:2087
vnsextop1.com:2096
vnsextop1.com:8443
www.vnsextop1.com:80
www.vnsextop1.com:22
www.vnsextop1.com:8080
www.vnsextop1.com:8880
www.vnsextop1.com:2052
www.vnsextop1.com:2082
www.vnsextop1.com:2086
www.vnsextop1.com:2095
www.vnsextop1.com:443
www.vnsextop1.com:2053
www.vnsextop1.com:2083
www.vnsextop1.com:2087
www.vnsextop1.com:2096
www.vnsextop1.com:8443
notpetya.vnsextop1.com:80
notpetya.vnsextop1.com:22
notpetya.vnsextop1.com:8080
notpetya.vnsextop1.com:8880
notpetya.vnsextop1.com:2052
notpetya.vnsextop1.com:2082
notpetya.vnsextop1.com:2086
notpetya.vnsextop1.com:2095
notpetya.vnsextop1.com:443
notpetya.vnsextop1.com:2053
notpetya.vnsextop1.com:2083
notpetya.vnsextop1.com:2087
notpetya.vnsextop1.com:2096
notpetya.vnsextop1.com:8443
wannacry.vnsextop1.com:80
wannacry.vnsextop1.com:22
wannacry.vnsextop1.com:8080
wannacry.vnsextop1.com:8880
wannacry.vnsextop1.com:2052
wannacry.vnsextop1.com:2082
wannacry.vnsextop1.com:2086
wannacry.vnsextop1.com:2095
wannacry.vnsextop1.com:443
wannacry.vnsextop1.com:2053
wannacry.vnsextop1.com:2083
wannacry.vnsextop1.com:2087
wannacry.vnsextop1.com:2096
wannacry.vnsextop1.com:8443
nimda.vnsextop1.com:80
nimda.vnsextop1.com:22
nimda.vnsextop1.com:8080
nimda.vnsextop1.com:8880
nimda.vnsextop1.com:2052
nimda.vnsextop1.com:2082
nimda.vnsextop1.com:2086
nimda.vnsextop1.com:2095
nimda.vnsextop1.com:443
nimda.vnsextop1.com:2053
nimda.vnsextop1.com:2083
nimda.vnsextop1.com:2087
nimda.vnsextop1.com:2096
nimda.vnsextop1.com:8443

Mutex

SP8I3HuljSzF

Attributes

delay
0
install
true
install_file
31y1yh.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  303fc34c19a845d805e0c94e928f9bd0740671b2c251c56530e22f62d870c833
- Size 45KB
- SHA256 303fc34c19a845d805e0c94e928f9bd0740671b2c251c56530e22f62d870c833
- MD5 f9c59729d532386cfb104939b6db4c85
- SHA1 8bb47b25ece8667f8f51c0954575f291a6552f21
- SHA512 dddcc7b9dcaf11c67130a20c9c92ced6b9afdd4703cf06fa6c88f292dc9e93d2194e388feff0e58c8e13e91f3e1d34fa14b8ce9da97ec378163ffcceff96b4f6
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q95dR3aI6OPIuzjbtg63i8xi8OY61XEcgf4Zm33ATvBc:EulCJTHl42mjqb3u3b66S8xlOYoXEcgL
- TLSH
  T111231B0037E8C12BF2BE4F7899F26145467EF6673603D68E1C8451DB5613FC68A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2