asyncrat | 02341416c2a51e184d006f82bc59b45ed4588bf733aa7ae05be544c24291cd73

Sharing

Copy URL Twitter E-mail

General

Target
02341416c2a51e184d006f82bc59b45ed4588bf733aa7ae05be544c24291cd73
Size 45KB
Sample260805-lrd6cayyes
SHA256 02341416c2a51e184d006f82bc59b45ed4588bf733aa7ae05be544c24291cd73
MD5 92580cbce8764df591f337f2ed3ff744
SHA1 653395e29f02489564816331b5db6b8cd8ec529d
SHA512 cd811a8d3f38a66cb1378d3fbace73e221fd465b202ca0ed6e4f2dd36a84ced2500108b2e72f8f4db041520232aa0e7188c9c42ab7612f3899b5f4dbb4b3ff05
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97Sz8yfzuOPIhzjbIgXjixoruNZtvwyBDZsx:EufspTf2g22SQJ3h3bfX+xnNZtwMdsx
TLSH
T1EE232A003BE8C13BF2BE5F7898F26145867AF6632603D64A1CC451DB5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

viet18.org:80
viet18.org:22
viet18.org:8080
viet18.org:8880
viet18.org:2052
viet18.org:2082
viet18.org:2086
viet18.org:2095
viet18.org:443
viet18.org:2053
viet18.org:2083
viet18.org:2087
viet18.org:2096
viet18.org:8443
www.viet18.org:80
www.viet18.org:22
www.viet18.org:8080
www.viet18.org:8880
www.viet18.org:2052
www.viet18.org:2082
www.viet18.org:2086
www.viet18.org:2095
www.viet18.org:443
www.viet18.org:2053
www.viet18.org:2083
www.viet18.org:2087
www.viet18.org:2096
www.viet18.org:8443
sasser.viet18.org:80
sasser.viet18.org:22
sasser.viet18.org:8080
sasser.viet18.org:8880
sasser.viet18.org:2052
sasser.viet18.org:2082
sasser.viet18.org:2086
sasser.viet18.org:2095
sasser.viet18.org:443
sasser.viet18.org:2053
sasser.viet18.org:2083
sasser.viet18.org:2087
sasser.viet18.org:2096
sasser.viet18.org:8443
remote.viet18.org:80
remote.viet18.org:22
remote.viet18.org:8080
remote.viet18.org:8880
remote.viet18.org:2052
remote.viet18.org:2082
remote.viet18.org:2086
remote.viet18.org:2095
remote.viet18.org:443
remote.viet18.org:2053
remote.viet18.org:2083
remote.viet18.org:2087
remote.viet18.org:2096
remote.viet18.org:8443
sodinokibi.viet18.org:80
sodinokibi.viet18.org:22
sodinokibi.viet18.org:8080
sodinokibi.viet18.org:8880
sodinokibi.viet18.org:2052
sodinokibi.viet18.org:2082
sodinokibi.viet18.org:2086
sodinokibi.viet18.org:2095
sodinokibi.viet18.org:443
sodinokibi.viet18.org:2053
sodinokibi.viet18.org:2083
sodinokibi.viet18.org:2087
sodinokibi.viet18.org:2096
sodinokibi.viet18.org:8443
conti.viet18.org:80
conti.viet18.org:22
conti.viet18.org:8080
conti.viet18.org:8880
conti.viet18.org:2052
conti.viet18.org:2082
conti.viet18.org:2086
conti.viet18.org:2095
conti.viet18.org:443
conti.viet18.org:2053
conti.viet18.org:2083
conti.viet18.org:2087
conti.viet18.org:2096
conti.viet18.org:8443

Mutex

nJcN9QhqFLyO

Attributes

delay
0
install
true
install_file
es6k6gp.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  02341416c2a51e184d006f82bc59b45ed4588bf733aa7ae05be544c24291cd73
- Size 45KB
- SHA256 02341416c2a51e184d006f82bc59b45ed4588bf733aa7ae05be544c24291cd73
- MD5 92580cbce8764df591f337f2ed3ff744
- SHA1 653395e29f02489564816331b5db6b8cd8ec529d
- SHA512 cd811a8d3f38a66cb1378d3fbace73e221fd465b202ca0ed6e4f2dd36a84ced2500108b2e72f8f4db041520232aa0e7188c9c42ab7612f3899b5f4dbb4b3ff05
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97Sz8yfzuOPIhzjbIgXjixoruNZtvwyBDZsx:EufspTf2g22SQJ3h3bfX+xnNZtwMdsx
- TLSH
  T1EE232A003BE8C13BF2BE5F7898F26145867AF6632603D64A1CC451DB5613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2