asyncrat | 9400fba15393413fa14baa8e557348a0c81c02da1d62f1ef725efe5857f579e9

Sharing

Copy URL Twitter E-mail

General

Target
9400fba15393413fa14baa8e557348a0c81c02da1d62f1ef725efe5857f579e9
Size 45KB
Sample260905-qd4ajaea58
SHA256 9400fba15393413fa14baa8e557348a0c81c02da1d62f1ef725efe5857f579e9
MD5 34b10b30565a45ea23667ddffdccba81
SHA1 011677114139520fb9734d054f4a93649d626c9c
SHA512 2908944e5b10484121978011a3d760d0d2fdca64f9c56e276d68aa5784a84a4256e6810a302afbc438d78a8d628561ef64937f8790dcbd5732443d686b5e09bc
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9lhkTwJaOPIcozjbWgri6CHiQHAb7QLc2TM40JBDZsx:EulCJTHl42V0w3co3bJm6SiQHAb7M445
TLSH
T15A232B003BE9822BF2BE4BB8A8F26145467EF5637603D58E1CC451DB5713BC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sextin.org:80
sextin.org:22
sextin.org:8080
sextin.org:8880
sextin.org:2052
sextin.org:2082
sextin.org:2086
sextin.org:2095
sextin.org:443
sextin.org:2053
sextin.org:2083
sextin.org:2087
sextin.org:2096
sextin.org:8443
www.sextin.org:80
www.sextin.org:22
www.sextin.org:8080
www.sextin.org:8880
www.sextin.org:2052
www.sextin.org:2082
www.sextin.org:2086
www.sextin.org:2095
www.sextin.org:443
www.sextin.org:2053
www.sextin.org:2083
www.sextin.org:2087
www.sextin.org:2096
www.sextin.org:8443
blacklotus.sextin.org:80
blacklotus.sextin.org:22
blacklotus.sextin.org:8080
blacklotus.sextin.org:8880
blacklotus.sextin.org:2052
blacklotus.sextin.org:2082
blacklotus.sextin.org:2086
blacklotus.sextin.org:2095
blacklotus.sextin.org:443
blacklotus.sextin.org:2053
blacklotus.sextin.org:2083
blacklotus.sextin.org:2087
blacklotus.sextin.org:2096
blacklotus.sextin.org:8443
nanocore.sextin.org:80
nanocore.sextin.org:22
nanocore.sextin.org:8080
nanocore.sextin.org:8880
nanocore.sextin.org:2052
nanocore.sextin.org:2082
nanocore.sextin.org:2086
nanocore.sextin.org:2095
nanocore.sextin.org:443
nanocore.sextin.org:2053
nanocore.sextin.org:2083
nanocore.sextin.org:2087
nanocore.sextin.org:2096
nanocore.sextin.org:8443
invasive.sextin.org:80
invasive.sextin.org:22
invasive.sextin.org:8080
invasive.sextin.org:8880
invasive.sextin.org:2052
invasive.sextin.org:2082
invasive.sextin.org:2086
invasive.sextin.org:2095
invasive.sextin.org:443
invasive.sextin.org:2053
invasive.sextin.org:2083
invasive.sextin.org:2087
invasive.sextin.org:2096
invasive.sextin.org:8443
connect.sextin.org:80
connect.sextin.org:22
connect.sextin.org:8080
connect.sextin.org:8880
connect.sextin.org:2052
connect.sextin.org:2082
connect.sextin.org:2086
connect.sextin.org:2095
connect.sextin.org:443
connect.sextin.org:2053
connect.sextin.org:2083
connect.sextin.org:2087
connect.sextin.org:2096
connect.sextin.org:8443

Mutex

rPq4hYN1wZTa

Attributes

delay
0
install
true
install_file
lyb1jn.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  9400fba15393413fa14baa8e557348a0c81c02da1d62f1ef725efe5857f579e9
- Size 45KB
- SHA256 9400fba15393413fa14baa8e557348a0c81c02da1d62f1ef725efe5857f579e9
- MD5 34b10b30565a45ea23667ddffdccba81
- SHA1 011677114139520fb9734d054f4a93649d626c9c
- SHA512 2908944e5b10484121978011a3d760d0d2fdca64f9c56e276d68aa5784a84a4256e6810a302afbc438d78a8d628561ef64937f8790dcbd5732443d686b5e09bc
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9lhkTwJaOPIcozjbWgri6CHiQHAb7QLc2TM40JBDZsx:EulCJTHl42V0w3co3bJm6SiQHAb7M445
- TLSH
  T15A232B003BE9822BF2BE4BB8A8F26145467EF5637603D58E1CC451DB5713BC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2