asyncrat | 5066758a21a36a794d5bf8ff906162317db0c2bc560a882eafd799ebf5a85974

Sharing

Copy URL Twitter E-mail

General

Target
5066758a21a36a794d5bf8ff906162317db0c2bc560a882eafd799ebf5a85974.exe
Size 45KB
Sample260703-lyrd9aey9t
SHA256 5066758a21a36a794d5bf8ff906162317db0c2bc560a882eafd799ebf5a85974
MD5 2e605f5ca15d6d3ee3ed4d88eeb3a49f
SHA1 930651db58a914dfd717ed96cfc0d90b68d57e2e
SHA512 1d00344f42d04eff12758dd3778a650329374bddc9e49db48ebac5c7ece39c2eaae9437c90678d973b2fe167e930763ad2a8ef48e45d4166a8da4975d7490c92
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0yFjrdjYkk8PIuXjbSgX3i3WZBYDYgmkBDZEx:MuBGJTPho2/LBXQBuzbVXS3wacvSdEx
TLSH
T1AD232B003BE9812BF2BE4B7858F26145867AF6732603D54E1CC451DB5723FC69A43AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsexvn.work:80
phimsexvn.work:22
phimsexvn.work:8080
phimsexvn.work:8880
phimsexvn.work:2052
phimsexvn.work:2082
phimsexvn.work:2086
phimsexvn.work:2095
phimsexvn.work:443
phimsexvn.work:2053
phimsexvn.work:2083
phimsexvn.work:2087
phimsexvn.work:2096
phimsexvn.work:8443
www.phimsexvn.work:80
www.phimsexvn.work:22
www.phimsexvn.work:8080
www.phimsexvn.work:8880
www.phimsexvn.work:2052
www.phimsexvn.work:2082
www.phimsexvn.work:2086
www.phimsexvn.work:2095
www.phimsexvn.work:443
www.phimsexvn.work:2053
www.phimsexvn.work:2083
www.phimsexvn.work:2087
www.phimsexvn.work:2096
www.phimsexvn.work:8443
invasive.phimsexvn.work:80
invasive.phimsexvn.work:22
invasive.phimsexvn.work:8080
invasive.phimsexvn.work:8880
invasive.phimsexvn.work:2052
invasive.phimsexvn.work:2082
invasive.phimsexvn.work:2086
invasive.phimsexvn.work:2095
invasive.phimsexvn.work:443
invasive.phimsexvn.work:2053
invasive.phimsexvn.work:2083
invasive.phimsexvn.work:2087
invasive.phimsexvn.work:2096
invasive.phimsexvn.work:8443
industroyer.phimsexvn.work:80
industroyer.phimsexvn.work:22
industroyer.phimsexvn.work:8080
industroyer.phimsexvn.work:8880
industroyer.phimsexvn.work:2052
industroyer.phimsexvn.work:2082
industroyer.phimsexvn.work:2086
industroyer.phimsexvn.work:2095
industroyer.phimsexvn.work:443
industroyer.phimsexvn.work:2053
industroyer.phimsexvn.work:2083
industroyer.phimsexvn.work:2087
industroyer.phimsexvn.work:2096
industroyer.phimsexvn.work:8443
downadup.phimsexvn.work:80
downadup.phimsexvn.work:22
downadup.phimsexvn.work:8080
downadup.phimsexvn.work:8880
downadup.phimsexvn.work:2052
downadup.phimsexvn.work:2082
downadup.phimsexvn.work:2086
downadup.phimsexvn.work:2095
downadup.phimsexvn.work:443
downadup.phimsexvn.work:2053
downadup.phimsexvn.work:2083
downadup.phimsexvn.work:2087
downadup.phimsexvn.work:2096
downadup.phimsexvn.work:8443

Mutex

Q06MHbXR1zdF

Attributes

delay
0
install
true
install_file
r8q7.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5066758a21a36a794d5bf8ff906162317db0c2bc560a882eafd799ebf5a85974.exe
- Size 45KB
- SHA256 5066758a21a36a794d5bf8ff906162317db0c2bc560a882eafd799ebf5a85974
- MD5 2e605f5ca15d6d3ee3ed4d88eeb3a49f
- SHA1 930651db58a914dfd717ed96cfc0d90b68d57e2e
- SHA512 1d00344f42d04eff12758dd3778a650329374bddc9e49db48ebac5c7ece39c2eaae9437c90678d973b2fe167e930763ad2a8ef48e45d4166a8da4975d7490c92
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0yFjrdjYkk8PIuXjbSgX3i3WZBYDYgmkBDZEx:MuBGJTPho2/LBXQBuzbVXS3wacvSdEx
- TLSH
  T1AD232B003BE9812BF2BE4B7858F26145867AF6732603D54E1CC451DB5723FC69A43AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2