asyncrat | ccc87983857e5351cf50169af0a84d7c4a580be9bcd60b40b0b014819d5cd3ce

Sharing

Copy URL Twitter E-mail

General

Target
ccc87983857e5351cf50169af0a84d7c4a580be9bcd60b40b0b014819d5cd3ce
Size 45KB
Sample260805-q7xd3stsbt
SHA256 ccc87983857e5351cf50169af0a84d7c4a580be9bcd60b40b0b014819d5cd3ce
MD5 5688f127271d12bb765d311fb3681550
SHA1 83974cf98c11811d2cbcaed8a1f0f86142fee19b
SHA512 8df6d00024d5916619114f8649556febc8b50396de4260343cbf8df8acde336ad7012fdaafa3e5fb10c32b3d661e47e5e4c34dd77563be43a31343d176ee5db2
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9m6R8aI3OPIOzjbDgy3isH3hZ7i056WAC5BDZ8x:0u1YJTHcw2Z+FO3O3bcySUZ7iQ5Hnd8x
TLSH
T195232A003BE9822BF2BE4FB89DF26145857EF6672602D54D1CC451D75613FC68A026FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

maymaykienlong.com:80
maymaykienlong.com:22
maymaykienlong.com:8080
maymaykienlong.com:8880
maymaykienlong.com:2052
maymaykienlong.com:2082
maymaykienlong.com:2086
maymaykienlong.com:2095
maymaykienlong.com:443
maymaykienlong.com:2053
maymaykienlong.com:2083
maymaykienlong.com:2087
maymaykienlong.com:2096
maymaykienlong.com:8443
www.maymaykienlong.com:80
www.maymaykienlong.com:22
www.maymaykienlong.com:8080
www.maymaykienlong.com:8880
www.maymaykienlong.com:2052
www.maymaykienlong.com:2082
www.maymaykienlong.com:2086
www.maymaykienlong.com:2095
www.maymaykienlong.com:443
www.maymaykienlong.com:2053
www.maymaykienlong.com:2083
www.maymaykienlong.com:2087
www.maymaykienlong.com:2096
www.maymaykienlong.com:8443
cl0p.maymaykienlong.com:80
cl0p.maymaykienlong.com:22
cl0p.maymaykienlong.com:8080
cl0p.maymaykienlong.com:8880
cl0p.maymaykienlong.com:2052
cl0p.maymaykienlong.com:2082
cl0p.maymaykienlong.com:2086
cl0p.maymaykienlong.com:2095
cl0p.maymaykienlong.com:443
cl0p.maymaykienlong.com:2053
cl0p.maymaykienlong.com:2083
cl0p.maymaykienlong.com:2087
cl0p.maymaykienlong.com:2096
cl0p.maymaykienlong.com:8443
invasive.maymaykienlong.com:80
invasive.maymaykienlong.com:22
invasive.maymaykienlong.com:8080
invasive.maymaykienlong.com:8880
invasive.maymaykienlong.com:2052
invasive.maymaykienlong.com:2082
invasive.maymaykienlong.com:2086
invasive.maymaykienlong.com:2095
invasive.maymaykienlong.com:443
invasive.maymaykienlong.com:2053
invasive.maymaykienlong.com:2083
invasive.maymaykienlong.com:2087
invasive.maymaykienlong.com:2096
invasive.maymaykienlong.com:8443

Mutex

WcwrFDHytqie

Attributes

delay
0
install
true
install_file
d02h6k.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  ccc87983857e5351cf50169af0a84d7c4a580be9bcd60b40b0b014819d5cd3ce
- Size 45KB
- SHA256 ccc87983857e5351cf50169af0a84d7c4a580be9bcd60b40b0b014819d5cd3ce
- MD5 5688f127271d12bb765d311fb3681550
- SHA1 83974cf98c11811d2cbcaed8a1f0f86142fee19b
- SHA512 8df6d00024d5916619114f8649556febc8b50396de4260343cbf8df8acde336ad7012fdaafa3e5fb10c32b3d661e47e5e4c34dd77563be43a31343d176ee5db2
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9m6R8aI3OPIOzjbDgy3isH3hZ7i056WAC5BDZ8x:0u1YJTHcw2Z+FO3O3bcySUZ7iQ5Hnd8x
- TLSH
  T195232A003BE9822BF2BE4FB89DF26145857EF6672602D54D1CC451D75613FC68A026FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2