asyncrat | 7cb0d9cc12e23f4b692c89bbde4de6f4836063860d24e7767b990fe00f6f15a2

Sharing

Copy URL Twitter E-mail

General

Target
7cb0d9cc12e23f4b692c89bbde4de6f4836063860d24e7767b990fe00f6f15a2
Size 45KB
Sample260704-yz8fdads8s
SHA256 7cb0d9cc12e23f4b692c89bbde4de6f4836063860d24e7767b990fe00f6f15a2
MD5 cd342642168b829bf742cd2f51aa1054
SHA1 76d5a458017b9292f219a9b5b0699a59199f51c2
SHA512 c349a4f1290456c38b7dccca1deec326ce8a9bb25e2aa603df4d88eb7b64bc2b461f6885ef2d7f075438df10eed8a87827488571ab0ccf7c3c21cb87acec4dd1
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE02FjMdjYkkmPI7zjbBgX3ir1gqt1h4vw4szBDo:kuSOpTPOP2KL9wQP73buXSBvtTfdMx
TLSH
T1B4231A003BE9822BF2BE4B78A8F251458677F5732603D54A1CC451DB5B13BC69A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsexvn.work:80
phimsexvn.work:22
phimsexvn.work:8080
phimsexvn.work:8880
phimsexvn.work:2052
phimsexvn.work:2082
phimsexvn.work:2086
phimsexvn.work:2095
phimsexvn.work:443
phimsexvn.work:2053
phimsexvn.work:2083
phimsexvn.work:2087
phimsexvn.work:2096
phimsexvn.work:8443
www.phimsexvn.work:80
www.phimsexvn.work:22
www.phimsexvn.work:8080
www.phimsexvn.work:8880
www.phimsexvn.work:2052
www.phimsexvn.work:2082
www.phimsexvn.work:2086
www.phimsexvn.work:2095
www.phimsexvn.work:443
www.phimsexvn.work:2053
www.phimsexvn.work:2083
www.phimsexvn.work:2087
www.phimsexvn.work:2096
www.phimsexvn.work:8443
qbot.phimsexvn.work:80
qbot.phimsexvn.work:22
qbot.phimsexvn.work:8080
qbot.phimsexvn.work:8880
qbot.phimsexvn.work:2052
qbot.phimsexvn.work:2082
qbot.phimsexvn.work:2086
qbot.phimsexvn.work:2095
qbot.phimsexvn.work:443
qbot.phimsexvn.work:2053
qbot.phimsexvn.work:2083
qbot.phimsexvn.work:2087
qbot.phimsexvn.work:2096
qbot.phimsexvn.work:8443
remcos.phimsexvn.work:80
remcos.phimsexvn.work:22
remcos.phimsexvn.work:8080
remcos.phimsexvn.work:8880
remcos.phimsexvn.work:2052
remcos.phimsexvn.work:2082
remcos.phimsexvn.work:2086
remcos.phimsexvn.work:2095
remcos.phimsexvn.work:443
remcos.phimsexvn.work:2053
remcos.phimsexvn.work:2083
remcos.phimsexvn.work:2087
remcos.phimsexvn.work:2096
remcos.phimsexvn.work:8443
ryuk.phimsexvn.work:80
ryuk.phimsexvn.work:22
ryuk.phimsexvn.work:8080
ryuk.phimsexvn.work:8880
ryuk.phimsexvn.work:2052
ryuk.phimsexvn.work:2082
ryuk.phimsexvn.work:2086
ryuk.phimsexvn.work:2095
ryuk.phimsexvn.work:443
ryuk.phimsexvn.work:2053
ryuk.phimsexvn.work:2083
ryuk.phimsexvn.work:2087
ryuk.phimsexvn.work:2096
ryuk.phimsexvn.work:8443
downadup.phimsexvn.work:80
downadup.phimsexvn.work:22
downadup.phimsexvn.work:8080
downadup.phimsexvn.work:8880
downadup.phimsexvn.work:2052
downadup.phimsexvn.work:2082
downadup.phimsexvn.work:2086
downadup.phimsexvn.work:2095
downadup.phimsexvn.work:443
downadup.phimsexvn.work:2053
downadup.phimsexvn.work:2083
downadup.phimsexvn.work:2087
downadup.phimsexvn.work:2096
downadup.phimsexvn.work:8443

Mutex

QUWGGiIR6oCx

Attributes

delay
0
install
true
install_file
c6b4.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  7cb0d9cc12e23f4b692c89bbde4de6f4836063860d24e7767b990fe00f6f15a2
- Size 45KB
- SHA256 7cb0d9cc12e23f4b692c89bbde4de6f4836063860d24e7767b990fe00f6f15a2
- MD5 cd342642168b829bf742cd2f51aa1054
- SHA1 76d5a458017b9292f219a9b5b0699a59199f51c2
- SHA512 c349a4f1290456c38b7dccca1deec326ce8a9bb25e2aa603df4d88eb7b64bc2b461f6885ef2d7f075438df10eed8a87827488571ab0ccf7c3c21cb87acec4dd1
- SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE02FjMdjYkkmPI7zjbBgX3ir1gqt1h4vw4szBDo:kuSOpTPOP2KL9wQP73buXSBvtTfdMx
- TLSH
  T1B4231A003BE9822BF2BE4B78A8F251458677F5732603D54A1CC451DB5B13BC69A43AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2