asyncrat | dff95d3379a34dde83010b627a2f3c6819c3e950a157bb41606d4db61248ef39

Sharing

Copy URL Twitter E-mail

General

Target
dff95d3379a34dde83010b627a2f3c6819c3e950a157bb41606d4db61248ef39
Size 45KB
Sample260905-l4s52asbld
SHA256 dff95d3379a34dde83010b627a2f3c6819c3e950a157bb41606d4db61248ef39
MD5 4175c0259155c5585c0cb1010b80c480
SHA1 349b918bd2efb99e9b820a4d57188defeb2eaff3
SHA512 b3246c754f01973260eb0f5bd9a1765d1919de68a39772c94f90620a46755330e6b7281377091e950211c19719e8f9eb6a5b0d399535fed67755285fa4f94410
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFyls5ohEaMPIS9jb+gX3inok59cA7OH9u2BiaBtBDZG:MuLAZTnbg2X44EaxSVbBXSrgFuMJBjdG
TLSH
T101232B003BE8822BF2BF5F78A8F26145467AF6632603D54D1CC4419B5B13FC69A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sextinvl.blog:80
sextinvl.blog:22
sextinvl.blog:8080
sextinvl.blog:8880
sextinvl.blog:2052
sextinvl.blog:2082
sextinvl.blog:2086
sextinvl.blog:2095
sextinvl.blog:443
sextinvl.blog:2053
sextinvl.blog:2083
sextinvl.blog:2087
sextinvl.blog:2096
sextinvl.blog:8443
www.sextinvl.blog:80
www.sextinvl.blog:22
www.sextinvl.blog:8080
www.sextinvl.blog:8880
www.sextinvl.blog:2052
www.sextinvl.blog:2082
www.sextinvl.blog:2086
www.sextinvl.blog:2095
www.sextinvl.blog:443
www.sextinvl.blog:2053
www.sextinvl.blog:2083
www.sextinvl.blog:2087
www.sextinvl.blog:2096
www.sextinvl.blog:8443
stuxnet.sextinvl.blog:80
stuxnet.sextinvl.blog:22
stuxnet.sextinvl.blog:8080
stuxnet.sextinvl.blog:8880
stuxnet.sextinvl.blog:2052
stuxnet.sextinvl.blog:2082
stuxnet.sextinvl.blog:2086
stuxnet.sextinvl.blog:2095
stuxnet.sextinvl.blog:443
stuxnet.sextinvl.blog:2053
stuxnet.sextinvl.blog:2083
stuxnet.sextinvl.blog:2087
stuxnet.sextinvl.blog:2096
stuxnet.sextinvl.blog:8443
darkside.sextinvl.blog:80
darkside.sextinvl.blog:22
darkside.sextinvl.blog:8080
darkside.sextinvl.blog:8880
darkside.sextinvl.blog:2052
darkside.sextinvl.blog:2082
darkside.sextinvl.blog:2086
darkside.sextinvl.blog:2095
darkside.sextinvl.blog:443
darkside.sextinvl.blog:2053
darkside.sextinvl.blog:2083
darkside.sextinvl.blog:2087
darkside.sextinvl.blog:2096
darkside.sextinvl.blog:8443
shamoon.sextinvl.blog:80
shamoon.sextinvl.blog:22
shamoon.sextinvl.blog:8080
shamoon.sextinvl.blog:8880
shamoon.sextinvl.blog:2052
shamoon.sextinvl.blog:2082
shamoon.sextinvl.blog:2086
shamoon.sextinvl.blog:2095
shamoon.sextinvl.blog:443
shamoon.sextinvl.blog:2053
shamoon.sextinvl.blog:2083
shamoon.sextinvl.blog:2087
shamoon.sextinvl.blog:2096
shamoon.sextinvl.blog:8443

Mutex

usap1UDneKl9

Attributes

delay
0
install
true
install_file
a3kla.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  dff95d3379a34dde83010b627a2f3c6819c3e950a157bb41606d4db61248ef39
- Size 45KB
- SHA256 dff95d3379a34dde83010b627a2f3c6819c3e950a157bb41606d4db61248ef39
- MD5 4175c0259155c5585c0cb1010b80c480
- SHA1 349b918bd2efb99e9b820a4d57188defeb2eaff3
- SHA512 b3246c754f01973260eb0f5bd9a1765d1919de68a39772c94f90620a46755330e6b7281377091e950211c19719e8f9eb6a5b0d399535fed67755285fa4f94410
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFyls5ohEaMPIS9jb+gX3inok59cA7OH9u2BiaBtBDZG:MuLAZTnbg2X44EaxSVbBXSrgFuMJBjdG
- TLSH
  T101232B003BE8822BF2BF5F78A8F26145467AF6632603D54D1CC4419B5B13FC69A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2