asyncrat | 401ec84ca4367424b027e406c84af20333bdc03c8279d225fe5a6ecb0d0febce

Sharing

Copy URL Twitter E-mail

General

Target
401ec84ca4367424b027e406c84af20333bdc03c8279d225fe5a6ecb0d0febce
Size 45KB
Sample260905-qkrv3svgrb
SHA256 401ec84ca4367424b027e406c84af20333bdc03c8279d225fe5a6ecb0d0febce
MD5 575c81eb9ebaf824a9a63131bcd0f5b3
SHA1 7916873194e6b8ead8b64a96db5f3656768801ac
SHA512 407e2807c4550aa3a21aad4b102e9a7923209ad2a6b1e7436944567236d1bd7e8683162c1a7f3ef55773c7d1df6287be73c2bd5c434f87c1c4bd326e5feb5b95
SSDEEP 768:suJdpTP3tcsWUODmqmo2qVWbqpG3jHuPItzjbVgXei4eZj5vcxilvAcZ0pBDZkx:suJdpTPdI27sM3t3byXnLvcxilt03dkx
TLSH
T167233A003BE8C127F2BE5FB8A8F26145467AF6737603DA4D1CC451DB4623BC69A426F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

nangcuc.blog:80
nangcuc.blog:22
nangcuc.blog:8080
nangcuc.blog:8880
nangcuc.blog:2052
nangcuc.blog:2082
nangcuc.blog:2086
nangcuc.blog:2095
nangcuc.blog:443
nangcuc.blog:2053
nangcuc.blog:2083
nangcuc.blog:2087
nangcuc.blog:2096
nangcuc.blog:8443
www.nangcuc.blog:80
www.nangcuc.blog:22
www.nangcuc.blog:8080
www.nangcuc.blog:8880
www.nangcuc.blog:2052
www.nangcuc.blog:2082
www.nangcuc.blog:2086
www.nangcuc.blog:2095
www.nangcuc.blog:443
www.nangcuc.blog:2053
www.nangcuc.blog:2083
www.nangcuc.blog:2087
www.nangcuc.blog:2096
www.nangcuc.blog:8443
ursnif.nangcuc.blog:80
ursnif.nangcuc.blog:22
ursnif.nangcuc.blog:8080
ursnif.nangcuc.blog:8880
ursnif.nangcuc.blog:2052
ursnif.nangcuc.blog:2082
ursnif.nangcuc.blog:2086
ursnif.nangcuc.blog:2095
ursnif.nangcuc.blog:443
ursnif.nangcuc.blog:2053
ursnif.nangcuc.blog:2083
ursnif.nangcuc.blog:2087
ursnif.nangcuc.blog:2096
ursnif.nangcuc.blog:8443
formbook.nangcuc.blog:80
formbook.nangcuc.blog:22
formbook.nangcuc.blog:8080
formbook.nangcuc.blog:8880
formbook.nangcuc.blog:2052
formbook.nangcuc.blog:2082
formbook.nangcuc.blog:2086
formbook.nangcuc.blog:2095
formbook.nangcuc.blog:443
formbook.nangcuc.blog:2053
formbook.nangcuc.blog:2083
formbook.nangcuc.blog:2087
formbook.nangcuc.blog:2096
formbook.nangcuc.blog:8443
blaster.nangcuc.blog:80
blaster.nangcuc.blog:22
blaster.nangcuc.blog:8080
blaster.nangcuc.blog:8880
blaster.nangcuc.blog:2052
blaster.nangcuc.blog:2082
blaster.nangcuc.blog:2086
blaster.nangcuc.blog:2095
blaster.nangcuc.blog:443
blaster.nangcuc.blog:2053
blaster.nangcuc.blog:2083
blaster.nangcuc.blog:2087
blaster.nangcuc.blog:2096
blaster.nangcuc.blog:8443

Mutex

soAciHevQiK6

Attributes

delay
0
install
true
install_file
zbpikhgp.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  401ec84ca4367424b027e406c84af20333bdc03c8279d225fe5a6ecb0d0febce
- Size 45KB
- SHA256 401ec84ca4367424b027e406c84af20333bdc03c8279d225fe5a6ecb0d0febce
- MD5 575c81eb9ebaf824a9a63131bcd0f5b3
- SHA1 7916873194e6b8ead8b64a96db5f3656768801ac
- SHA512 407e2807c4550aa3a21aad4b102e9a7923209ad2a6b1e7436944567236d1bd7e8683162c1a7f3ef55773c7d1df6287be73c2bd5c434f87c1c4bd326e5feb5b95
- SSDEEP 768:suJdpTP3tcsWUODmqmo2qVWbqpG3jHuPItzjbVgXei4eZj5vcxilvAcZ0pBDZkx:suJdpTPdI27sM3t3byXnLvcxilt03dkx
- TLSH
  T167233A003BE8C127F2BE5FB8A8F26145467AF6737603DA4D1CC451DB4623BC69A426F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2