asyncrat | 2b7df25bd7f754b6bc3e5f7873d2d459b8272bd60cf6172fc841c44e61605a89

Sharing

Copy URL Twitter E-mail

General

Target
2b7df25bd7f754b6bc3e5f7873d2d459b8272bd60cf6172fc841c44e61605a89
Size 45KB
Sample260905-m2s8pabj5w
SHA256 2b7df25bd7f754b6bc3e5f7873d2d459b8272bd60cf6172fc841c44e61605a89
MD5 22b5aa34e3e1537ea73fed3f9c18e5cf
SHA1 937d7a1c617b8ab85439e51d7c7730ba73e00084
SHA512 cb5e2d20b89b8d35ccd36bed0708999f05273de56a18dac4c50416bb9c8579624d2325fe3b6f64d204c495faac69a5d4c36307d025fae9100b9c763be0275e8f
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjb7gX3iWWuBOCJBDZEx:MuLAZTnbg2vSAvQZh6OAE3bEXSWpLdEx
TLSH
T1DC232A003BE9C12BF2BF4F78A9F26145867EF2632603D54A1CC451DB4713BC69A52AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexvn99.com:80
sexvn99.com:22
sexvn99.com:8080
sexvn99.com:8880
sexvn99.com:2052
sexvn99.com:2082
sexvn99.com:2086
sexvn99.com:2095
sexvn99.com:443
sexvn99.com:2053
sexvn99.com:2083
sexvn99.com:2087
sexvn99.com:2096
sexvn99.com:8443
www.sexvn99.com:80
www.sexvn99.com:22
www.sexvn99.com:8080
www.sexvn99.com:8880
www.sexvn99.com:2052
www.sexvn99.com:2082
www.sexvn99.com:2086
www.sexvn99.com:2095
www.sexvn99.com:443
www.sexvn99.com:2053
www.sexvn99.com:2083
www.sexvn99.com:2087
www.sexvn99.com:2096
www.sexvn99.com:8443
stuxnet.sexvn99.com:80
stuxnet.sexvn99.com:22
stuxnet.sexvn99.com:8080
stuxnet.sexvn99.com:8880
stuxnet.sexvn99.com:2052
stuxnet.sexvn99.com:2082
stuxnet.sexvn99.com:2086
stuxnet.sexvn99.com:2095
stuxnet.sexvn99.com:443
stuxnet.sexvn99.com:2053
stuxnet.sexvn99.com:2083
stuxnet.sexvn99.com:2087
stuxnet.sexvn99.com:2096
stuxnet.sexvn99.com:8443
cl0p.sexvn99.com:80
cl0p.sexvn99.com:22
cl0p.sexvn99.com:8080
cl0p.sexvn99.com:8880
cl0p.sexvn99.com:2052
cl0p.sexvn99.com:2082
cl0p.sexvn99.com:2086
cl0p.sexvn99.com:2095
cl0p.sexvn99.com:443
cl0p.sexvn99.com:2053
cl0p.sexvn99.com:2083
cl0p.sexvn99.com:2087
cl0p.sexvn99.com:2096
cl0p.sexvn99.com:8443
mydoom.sexvn99.com:80
mydoom.sexvn99.com:22
mydoom.sexvn99.com:8080
mydoom.sexvn99.com:8880
mydoom.sexvn99.com:2052
mydoom.sexvn99.com:2082
mydoom.sexvn99.com:2086
mydoom.sexvn99.com:2095
mydoom.sexvn99.com:443
mydoom.sexvn99.com:2053
mydoom.sexvn99.com:2083
mydoom.sexvn99.com:2087
mydoom.sexvn99.com:2096
mydoom.sexvn99.com:8443
ryuk.sexvn99.com:80
ryuk.sexvn99.com:22
ryuk.sexvn99.com:8080
ryuk.sexvn99.com:8880
ryuk.sexvn99.com:2052
ryuk.sexvn99.com:2082
ryuk.sexvn99.com:2086
ryuk.sexvn99.com:2095
ryuk.sexvn99.com:443
ryuk.sexvn99.com:2053
ryuk.sexvn99.com:2083
ryuk.sexvn99.com:2087
ryuk.sexvn99.com:2096
ryuk.sexvn99.com:8443

Mutex

tgVgGlrmEJM9

Attributes

delay
0
install
true
install_file
42xuz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2b7df25bd7f754b6bc3e5f7873d2d459b8272bd60cf6172fc841c44e61605a89
- Size 45KB
- SHA256 2b7df25bd7f754b6bc3e5f7873d2d459b8272bd60cf6172fc841c44e61605a89
- MD5 22b5aa34e3e1537ea73fed3f9c18e5cf
- SHA1 937d7a1c617b8ab85439e51d7c7730ba73e00084
- SHA512 cb5e2d20b89b8d35ccd36bed0708999f05273de56a18dac4c50416bb9c8579624d2325fe3b6f64d204c495faac69a5d4c36307d025fae9100b9c763be0275e8f
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjb7gX3iWWuBOCJBDZEx:MuLAZTnbg2vSAvQZh6OAE3bEXSWpLdEx
- TLSH
  T1DC232A003BE9C12BF2BF4F78A9F26145867EF2632603D54A1CC451DB4713BC69A52AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2