asyncrat | e4048bc95d47a6cbadce89f29015dbfc38c7015594416d9cb7f23c86c0c9f45d

Sharing

Copy URL Twitter E-mail

General

Target
e4048bc95d47a6cbadce89f29015dbfc38c7015594416d9cb7f23c86c0c9f45d
Size 45KB
Sample260805-rqvplatzf1
SHA256 e4048bc95d47a6cbadce89f29015dbfc38c7015594416d9cb7f23c86c0c9f45d
MD5 3baa67633f3b9cf83f293783a7fa18c3
SHA1 dbdf33b77cab4661629dc2daa57a92d778c9f7d8
SHA512 bc2d411e2ac34ca0cbdab2c193d291736dd3ed3824ab01b49ac53111aeee57306dc0a3fdc5c96f7059a72b0597f0dbaf6fc0a6407be18203275247ed294969bb
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAQBz3QKx7PIQojbfgX3ioPOlaKuEXzOiQBDZcx:UuKWgSJTwRf2gV0QAboXSoaPhCndcx
TLSH
T1D1231B003BE98137F2BE5FB8A8F26145467AF6732603D5492CC451D75623FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

maymaykienlong.com:80
maymaykienlong.com:22
maymaykienlong.com:8080
maymaykienlong.com:8880
maymaykienlong.com:2052
maymaykienlong.com:2082
maymaykienlong.com:2086
maymaykienlong.com:2095
maymaykienlong.com:443
maymaykienlong.com:2053
maymaykienlong.com:2083
maymaykienlong.com:2087
maymaykienlong.com:2096
maymaykienlong.com:8443
www.maymaykienlong.com:80
www.maymaykienlong.com:22
www.maymaykienlong.com:8080
www.maymaykienlong.com:8880
www.maymaykienlong.com:2052
www.maymaykienlong.com:2082
www.maymaykienlong.com:2086
www.maymaykienlong.com:2095
www.maymaykienlong.com:443
www.maymaykienlong.com:2053
www.maymaykienlong.com:2083
www.maymaykienlong.com:2087
www.maymaykienlong.com:2096
www.maymaykienlong.com:8443
darkside.maymaykienlong.com:80
darkside.maymaykienlong.com:22
darkside.maymaykienlong.com:8080
darkside.maymaykienlong.com:8880
darkside.maymaykienlong.com:2052
darkside.maymaykienlong.com:2082
darkside.maymaykienlong.com:2086
darkside.maymaykienlong.com:2095
darkside.maymaykienlong.com:443
darkside.maymaykienlong.com:2053
darkside.maymaykienlong.com:2083
darkside.maymaykienlong.com:2087
darkside.maymaykienlong.com:2096
darkside.maymaykienlong.com:8443
melissa.maymaykienlong.com:80
melissa.maymaykienlong.com:22
melissa.maymaykienlong.com:8080
melissa.maymaykienlong.com:8880
melissa.maymaykienlong.com:2052
melissa.maymaykienlong.com:2082
melissa.maymaykienlong.com:2086
melissa.maymaykienlong.com:2095
melissa.maymaykienlong.com:443
melissa.maymaykienlong.com:2053
melissa.maymaykienlong.com:2083
melissa.maymaykienlong.com:2087
melissa.maymaykienlong.com:2096
melissa.maymaykienlong.com:8443
gozi.maymaykienlong.com:80
gozi.maymaykienlong.com:22
gozi.maymaykienlong.com:8080
gozi.maymaykienlong.com:8880
gozi.maymaykienlong.com:2052
gozi.maymaykienlong.com:2082
gozi.maymaykienlong.com:2086
gozi.maymaykienlong.com:2095
gozi.maymaykienlong.com:443
gozi.maymaykienlong.com:2053
gozi.maymaykienlong.com:2083
gozi.maymaykienlong.com:2087
gozi.maymaykienlong.com:2096
gozi.maymaykienlong.com:8443

Mutex

JD9lQrc59R9B

Attributes

delay
0
install
true
install_file
nc74fgdb.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  e4048bc95d47a6cbadce89f29015dbfc38c7015594416d9cb7f23c86c0c9f45d
- Size 45KB
- SHA256 e4048bc95d47a6cbadce89f29015dbfc38c7015594416d9cb7f23c86c0c9f45d
- MD5 3baa67633f3b9cf83f293783a7fa18c3
- SHA1 dbdf33b77cab4661629dc2daa57a92d778c9f7d8
- SHA512 bc2d411e2ac34ca0cbdab2c193d291736dd3ed3824ab01b49ac53111aeee57306dc0a3fdc5c96f7059a72b0597f0dbaf6fc0a6407be18203275247ed294969bb
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAQBz3QKx7PIQojbfgX3ioPOlaKuEXzOiQBDZcx:UuKWgSJTwRf2gV0QAboXSoaPhCndcx
- TLSH
  T1D1231B003BE98137F2BE5FB8A8F26145467AF6732603D5492CC451D75623FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2