asyncrat | 4ea9b41c3daa29553c2dc264e8f6b9ea722f20aa568168645b1be4527eb607b8

Sharing

Copy URL Twitter E-mail

General

Target
4ea9b41c3daa29553c2dc264e8f6b9ea722f20aa568168645b1be4527eb607b8
Size 45KB
Sample260905-nnry5szyex
SHA256 4ea9b41c3daa29553c2dc264e8f6b9ea722f20aa568168645b1be4527eb607b8
MD5 fbc4a54450e2e24b4fa3868e67b870cc
SHA1 8119eee232d2360071e0d446c4c7ed7a792a6559
SHA512 1356e204e43163f16dff306d331d292fee00d1b5d02581040e00db67e328ef5972463392f923bf7b255cb0fb17f14606fcb113195dc643460fe07792d6aa9cb6
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4T9YikqHztOPIUzjb+RgZ3iJdsloOFL4lXoEsZBWd:8uUIpT4vAj2XalK3U3bJZSvsL4lob8yU
TLSH
T1EB232A003BE8C22BF2BE5F7898F26145867AF5633603D6491CC452DB5B13BC68A526FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sextinvl.blog:80
sextinvl.blog:22
sextinvl.blog:8080
sextinvl.blog:8880
sextinvl.blog:2052
sextinvl.blog:2082
sextinvl.blog:2086
sextinvl.blog:2095
sextinvl.blog:443
sextinvl.blog:2053
sextinvl.blog:2083
sextinvl.blog:2087
sextinvl.blog:2096
sextinvl.blog:8443
www.sextinvl.blog:80
www.sextinvl.blog:22
www.sextinvl.blog:8080
www.sextinvl.blog:8880
www.sextinvl.blog:2052
www.sextinvl.blog:2082
www.sextinvl.blog:2086
www.sextinvl.blog:2095
www.sextinvl.blog:443
www.sextinvl.blog:2053
www.sextinvl.blog:2083
www.sextinvl.blog:2087
www.sextinvl.blog:2096
www.sextinvl.blog:8443
connect.sextinvl.blog:80
connect.sextinvl.blog:22
connect.sextinvl.blog:8080
connect.sextinvl.blog:8880
connect.sextinvl.blog:2052
connect.sextinvl.blog:2082
connect.sextinvl.blog:2086
connect.sextinvl.blog:2095
connect.sextinvl.blog:443
connect.sextinvl.blog:2053
connect.sextinvl.blog:2083
connect.sextinvl.blog:2087
connect.sextinvl.blog:2096
connect.sextinvl.blog:8443
stuxnet.sextinvl.blog:80
stuxnet.sextinvl.blog:22
stuxnet.sextinvl.blog:8080
stuxnet.sextinvl.blog:8880
stuxnet.sextinvl.blog:2052
stuxnet.sextinvl.blog:2082
stuxnet.sextinvl.blog:2086
stuxnet.sextinvl.blog:2095
stuxnet.sextinvl.blog:443
stuxnet.sextinvl.blog:2053
stuxnet.sextinvl.blog:2083
stuxnet.sextinvl.blog:2087
stuxnet.sextinvl.blog:2096
stuxnet.sextinvl.blog:8443
sobig.sextinvl.blog:80
sobig.sextinvl.blog:22
sobig.sextinvl.blog:8080
sobig.sextinvl.blog:8880
sobig.sextinvl.blog:2052
sobig.sextinvl.blog:2082
sobig.sextinvl.blog:2086
sobig.sextinvl.blog:2095
sobig.sextinvl.blog:443
sobig.sextinvl.blog:2053
sobig.sextinvl.blog:2083
sobig.sextinvl.blog:2087
sobig.sextinvl.blog:2096
sobig.sextinvl.blog:8443
melissa.sextinvl.blog:80
melissa.sextinvl.blog:22
melissa.sextinvl.blog:8080
melissa.sextinvl.blog:8880
melissa.sextinvl.blog:2052
melissa.sextinvl.blog:2082
melissa.sextinvl.blog:2086
melissa.sextinvl.blog:2095
melissa.sextinvl.blog:443
melissa.sextinvl.blog:2053
melissa.sextinvl.blog:2083
melissa.sextinvl.blog:2087
melissa.sextinvl.blog:2096
melissa.sextinvl.blog:8443

Mutex

aLMlItBWcqfL

Attributes

delay
0
install
true
install_file
9d7lvsg.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4ea9b41c3daa29553c2dc264e8f6b9ea722f20aa568168645b1be4527eb607b8
- Size 45KB
- SHA256 4ea9b41c3daa29553c2dc264e8f6b9ea722f20aa568168645b1be4527eb607b8
- MD5 fbc4a54450e2e24b4fa3868e67b870cc
- SHA1 8119eee232d2360071e0d446c4c7ed7a792a6559
- SHA512 1356e204e43163f16dff306d331d292fee00d1b5d02581040e00db67e328ef5972463392f923bf7b255cb0fb17f14606fcb113195dc643460fe07792d6aa9cb6
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4T9YikqHztOPIUzjb+RgZ3iJdsloOFL4lXoEsZBWd:8uUIpT4vAj2XalK3U3bJZSvsL4lob8yU
- TLSH
  T1EB232A003BE8C22BF2BE5F7898F26145867AF5633603D6491CC452DB5B13BC68A526FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2