asyncrat | 0cf61f9fbf5a3a3d1908d607a0ba60bb63b7369ef5066df20ea805e931c3a065

Sharing

Copy URL Twitter E-mail

General

Target
0cf61f9fbf5a3a3d1908d607a0ba60bb63b7369ef5066df20ea805e931c3a065
Size 45KB
Sample260907-s82rasysht
SHA256 0cf61f9fbf5a3a3d1908d607a0ba60bb63b7369ef5066df20ea805e931c3a065
MD5 e27fd5dcc2c3f97460a43cd73eb00f28
SHA1 1b8cff19fc28e7fd8e2c733e20ab64a36afbef04
SHA512 16443a6133ed4bff8836c09de774d9912e0f8861ec0479f39ebdba353f63bd4dd35fff265e901a49597dad26be3315ba662dcdbd23b890cc1b63725f1e6ab4af
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtSc30oiZPI3zjbugX3imvCRgAQMcEYPbBDZEx:MuBGJTPho2tww2iW33bRXSGCGccEudEx
TLSH
T10E2319003BE9812BF2BE4F7899F26145867AF5636603D5491CC441DB5623FC6CA43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vlxxtv.org:80
vlxxtv.org:22
vlxxtv.org:8080
vlxxtv.org:8880
vlxxtv.org:2052
vlxxtv.org:2082
vlxxtv.org:2086
vlxxtv.org:2095
vlxxtv.org:443
vlxxtv.org:2053
vlxxtv.org:2083
vlxxtv.org:2087
vlxxtv.org:2096
vlxxtv.org:8443
www.vlxxtv.org:80
www.vlxxtv.org:22
www.vlxxtv.org:8080
www.vlxxtv.org:8880
www.vlxxtv.org:2052
www.vlxxtv.org:2082
www.vlxxtv.org:2086
www.vlxxtv.org:2095
www.vlxxtv.org:443
www.vlxxtv.org:2053
www.vlxxtv.org:2083
www.vlxxtv.org:2087
www.vlxxtv.org:2096
www.vlxxtv.org:8443
mydoom.vlxxtv.org:80
mydoom.vlxxtv.org:22
mydoom.vlxxtv.org:8080
mydoom.vlxxtv.org:8880
mydoom.vlxxtv.org:2052
mydoom.vlxxtv.org:2082
mydoom.vlxxtv.org:2086
mydoom.vlxxtv.org:2095
mydoom.vlxxtv.org:443
mydoom.vlxxtv.org:2053
mydoom.vlxxtv.org:2083
mydoom.vlxxtv.org:2087
mydoom.vlxxtv.org:2096
mydoom.vlxxtv.org:8443
triton.vlxxtv.org:80
triton.vlxxtv.org:22
triton.vlxxtv.org:8080
triton.vlxxtv.org:8880
triton.vlxxtv.org:2052
triton.vlxxtv.org:2082
triton.vlxxtv.org:2086
triton.vlxxtv.org:2095
triton.vlxxtv.org:443
triton.vlxxtv.org:2053
triton.vlxxtv.org:2083
triton.vlxxtv.org:2087
triton.vlxxtv.org:2096
triton.vlxxtv.org:8443
industroyer.vlxxtv.org:80
industroyer.vlxxtv.org:22
industroyer.vlxxtv.org:8080
industroyer.vlxxtv.org:8880
industroyer.vlxxtv.org:2052
industroyer.vlxxtv.org:2082
industroyer.vlxxtv.org:2086
industroyer.vlxxtv.org:2095
industroyer.vlxxtv.org:443
industroyer.vlxxtv.org:2053
industroyer.vlxxtv.org:2083
industroyer.vlxxtv.org:2087
industroyer.vlxxtv.org:2096
industroyer.vlxxtv.org:8443
nanocore.vlxxtv.org:80
nanocore.vlxxtv.org:22
nanocore.vlxxtv.org:8080
nanocore.vlxxtv.org:8880
nanocore.vlxxtv.org:2052
nanocore.vlxxtv.org:2082
nanocore.vlxxtv.org:2086
nanocore.vlxxtv.org:2095
nanocore.vlxxtv.org:443
nanocore.vlxxtv.org:2053
nanocore.vlxxtv.org:2083
nanocore.vlxxtv.org:2087
nanocore.vlxxtv.org:2096
nanocore.vlxxtv.org:8443

Mutex

JhzFMAoz5te1

Attributes

delay
0
install
true
install_file
o96f.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  0cf61f9fbf5a3a3d1908d607a0ba60bb63b7369ef5066df20ea805e931c3a065
- Size 45KB
- SHA256 0cf61f9fbf5a3a3d1908d607a0ba60bb63b7369ef5066df20ea805e931c3a065
- MD5 e27fd5dcc2c3f97460a43cd73eb00f28
- SHA1 1b8cff19fc28e7fd8e2c733e20ab64a36afbef04
- SHA512 16443a6133ed4bff8836c09de774d9912e0f8861ec0479f39ebdba353f63bd4dd35fff265e901a49597dad26be3315ba662dcdbd23b890cc1b63725f1e6ab4af
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtSc30oiZPI3zjbugX3imvCRgAQMcEYPbBDZEx:MuBGJTPho2tww2iW33bRXSGCGccEudEx
- TLSH
  T10E2319003BE9812BF2BE4F7899F26145867AF5636603D5491CC441DB5623FC6CA43AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2