asyncrat | f5d4ad392504585d8e0bf748aad12a8cc2526d2ac8fe25f56c446318491c148b

Sharing

Copy URL Twitter E-mail

General

Target
f5d4ad392504585d8e0bf748aad12a8cc2526d2ac8fe25f56c446318491c148b
Size 45KB
Sample260703-sfkbjsbv9y
SHA256 f5d4ad392504585d8e0bf748aad12a8cc2526d2ac8fe25f56c446318491c148b
MD5 b8cf86c0d86910b3f75b00ba27c18135
SHA1 8b43183277fbe2408762f68efecde1ec1c06b37a
SHA512 45cca19ff85d90f8e6a7ac48f590f851fbe1551e89d34c6eb44cb6dba418a07879ceb3d209e0c4f168244b7f55391f8b472a58f9d69845dd6c0d5fc3e4da8e57
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1RpPEcPIMzjbtgX3iDilx5eFj3F7j1X4sTBDZMx:kuSOpTPOP2W8VDZEhM3b6XSDUx5eFjVW
TLSH
T158233C003BE9823BF2BE4F7899F26145863AF2636603D5491CC451DB5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsexvn.work:80
phimsexvn.work:22
phimsexvn.work:8080
phimsexvn.work:8880
phimsexvn.work:2052
phimsexvn.work:2082
phimsexvn.work:2086
phimsexvn.work:2095
phimsexvn.work:443
phimsexvn.work:2053
phimsexvn.work:2083
phimsexvn.work:2087
phimsexvn.work:2096
phimsexvn.work:8443
www.phimsexvn.work:80
www.phimsexvn.work:22
www.phimsexvn.work:8080
www.phimsexvn.work:8880
www.phimsexvn.work:2052
www.phimsexvn.work:2082
www.phimsexvn.work:2086
www.phimsexvn.work:2095
www.phimsexvn.work:443
www.phimsexvn.work:2053
www.phimsexvn.work:2083
www.phimsexvn.work:2087
www.phimsexvn.work:2096
www.phimsexvn.work:8443
trickbot.phimsexvn.work:80
trickbot.phimsexvn.work:22
trickbot.phimsexvn.work:8080
trickbot.phimsexvn.work:8880
trickbot.phimsexvn.work:2052
trickbot.phimsexvn.work:2082
trickbot.phimsexvn.work:2086
trickbot.phimsexvn.work:2095
trickbot.phimsexvn.work:443
trickbot.phimsexvn.work:2053
trickbot.phimsexvn.work:2083
trickbot.phimsexvn.work:2087
trickbot.phimsexvn.work:2096
trickbot.phimsexvn.work:8443
hacker.phimsexvn.work:80
hacker.phimsexvn.work:22
hacker.phimsexvn.work:8080
hacker.phimsexvn.work:8880
hacker.phimsexvn.work:2052
hacker.phimsexvn.work:2082
hacker.phimsexvn.work:2086
hacker.phimsexvn.work:2095
hacker.phimsexvn.work:443
hacker.phimsexvn.work:2053
hacker.phimsexvn.work:2083
hacker.phimsexvn.work:2087
hacker.phimsexvn.work:2096
hacker.phimsexvn.work:8443
mydoom.phimsexvn.work:80
mydoom.phimsexvn.work:22
mydoom.phimsexvn.work:8080
mydoom.phimsexvn.work:8880
mydoom.phimsexvn.work:2052
mydoom.phimsexvn.work:2082
mydoom.phimsexvn.work:2086
mydoom.phimsexvn.work:2095
mydoom.phimsexvn.work:443
mydoom.phimsexvn.work:2053
mydoom.phimsexvn.work:2083
mydoom.phimsexvn.work:2087
mydoom.phimsexvn.work:2096
mydoom.phimsexvn.work:8443
cl0p.phimsexvn.work:80
cl0p.phimsexvn.work:22
cl0p.phimsexvn.work:8080
cl0p.phimsexvn.work:8880
cl0p.phimsexvn.work:2052
cl0p.phimsexvn.work:2082
cl0p.phimsexvn.work:2086
cl0p.phimsexvn.work:2095
cl0p.phimsexvn.work:443
cl0p.phimsexvn.work:2053
cl0p.phimsexvn.work:2083
cl0p.phimsexvn.work:2087
cl0p.phimsexvn.work:2096
cl0p.phimsexvn.work:8443

Mutex

QPyH7tEe0k97

Attributes

delay
0
install
true
install_file
2equ.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  f5d4ad392504585d8e0bf748aad12a8cc2526d2ac8fe25f56c446318491c148b
- Size 45KB
- SHA256 f5d4ad392504585d8e0bf748aad12a8cc2526d2ac8fe25f56c446318491c148b
- MD5 b8cf86c0d86910b3f75b00ba27c18135
- SHA1 8b43183277fbe2408762f68efecde1ec1c06b37a
- SHA512 45cca19ff85d90f8e6a7ac48f590f851fbe1551e89d34c6eb44cb6dba418a07879ceb3d209e0c4f168244b7f55391f8b472a58f9d69845dd6c0d5fc3e4da8e57
- SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1RpPEcPIMzjbtgX3iDilx5eFj3F7j1X4sTBDZMx:kuSOpTPOP2W8VDZEhM3b6XSDUx5eFjVW
- TLSH
  T158233C003BE9823BF2BE4F7899F26145863AF2636603D5491CC451DB5723FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2