asyncrat | 8cf301593c1d6e27b317b237f0b2fc61a9a400d45c5e3f9c0e587facdc2e85b4

Sharing

Copy URL Twitter E-mail

General

Target
8cf301593c1d6e27b317b237f0b2fc61a9a400d45c5e3f9c0e587facdc2e85b4
Size 45KB
Sample260805-ncnscaem8w
SHA256 8cf301593c1d6e27b317b237f0b2fc61a9a400d45c5e3f9c0e587facdc2e85b4
MD5 d938028c6ae65b08e35a0c525e0f149e
SHA1 015cd5e4791d7d637bf2d2352017095419f1efa4
SHA512 02f7bb9f205a970a8dff84ba45548f2750ba019d086adbb493d7011d30f003566fcaf1690587e19ad288e975602a02c16a3b4cf7911a7539fca6a919deb548e6
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9KRzMwcOPIgzjbmgX3ip+igzbvglBDZ8x:0u1YJTHcw2bAd3g3b5XS8bzsrd8x
TLSH
T1FA2319003BE8822BF2BE4F78ACF25245867AF5672603D58A1CC451D75B13BC6DA426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

maymaykienlong.com:80
maymaykienlong.com:22
maymaykienlong.com:8080
maymaykienlong.com:8880
maymaykienlong.com:2052
maymaykienlong.com:2082
maymaykienlong.com:2086
maymaykienlong.com:2095
maymaykienlong.com:443
maymaykienlong.com:2053
maymaykienlong.com:2083
maymaykienlong.com:2087
maymaykienlong.com:2096
maymaykienlong.com:8443
www.maymaykienlong.com:80
www.maymaykienlong.com:22
www.maymaykienlong.com:8080
www.maymaykienlong.com:8880
www.maymaykienlong.com:2052
www.maymaykienlong.com:2082
www.maymaykienlong.com:2086
www.maymaykienlong.com:2095
www.maymaykienlong.com:443
www.maymaykienlong.com:2053
www.maymaykienlong.com:2083
www.maymaykienlong.com:2087
www.maymaykienlong.com:2096
www.maymaykienlong.com:8443
gozi.maymaykienlong.com:80
gozi.maymaykienlong.com:22
gozi.maymaykienlong.com:8080
gozi.maymaykienlong.com:8880
gozi.maymaykienlong.com:2052
gozi.maymaykienlong.com:2082
gozi.maymaykienlong.com:2086
gozi.maymaykienlong.com:2095
gozi.maymaykienlong.com:443
gozi.maymaykienlong.com:2053
gozi.maymaykienlong.com:2083
gozi.maymaykienlong.com:2087
gozi.maymaykienlong.com:2096
gozi.maymaykienlong.com:8443
blaster.maymaykienlong.com:80
blaster.maymaykienlong.com:22
blaster.maymaykienlong.com:8080
blaster.maymaykienlong.com:8880
blaster.maymaykienlong.com:2052
blaster.maymaykienlong.com:2082
blaster.maymaykienlong.com:2086
blaster.maymaykienlong.com:2095
blaster.maymaykienlong.com:443
blaster.maymaykienlong.com:2053
blaster.maymaykienlong.com:2083
blaster.maymaykienlong.com:2087
blaster.maymaykienlong.com:2096
blaster.maymaykienlong.com:8443

Mutex

dkIsAFm5y0Ie

Attributes

delay
0
install
true
install_file
tgeyig.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  8cf301593c1d6e27b317b237f0b2fc61a9a400d45c5e3f9c0e587facdc2e85b4
- Size 45KB
- SHA256 8cf301593c1d6e27b317b237f0b2fc61a9a400d45c5e3f9c0e587facdc2e85b4
- MD5 d938028c6ae65b08e35a0c525e0f149e
- SHA1 015cd5e4791d7d637bf2d2352017095419f1efa4
- SHA512 02f7bb9f205a970a8dff84ba45548f2750ba019d086adbb493d7011d30f003566fcaf1690587e19ad288e975602a02c16a3b4cf7911a7539fca6a919deb548e6
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9KRzMwcOPIgzjbmgX3ip+igzbvglBDZ8x:0u1YJTHcw2bAd3g3b5XS8bzsrd8x
- TLSH
  T1FA2319003BE8822BF2BE4F78ACF25245867AF5672603D58A1CC451D75B13BC6DA426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2