asyncrat | 755c556434c44aeba78db4a882883c50a0dc25d096704005d4fa31145f4dcb25

Sharing

Copy URL Twitter E-mail

General

Target
755c556434c44aeba78db4a882883c50a0dc25d096704005d4fa31145f4dcb25
Size 45KB
Sample260706-xg84hsb15z
SHA256 755c556434c44aeba78db4a882883c50a0dc25d096704005d4fa31145f4dcb25
MD5 d4819dc57db3f7021de3854cfe2e8a2c
SHA1 06489c1188e085a5d7672726806c2e0a123bd1cd
SHA512 45d61ae529536b17dd1b071526fb1e5e139dcdd0ec4f6feb0de397e18a2795a2738ff93b2e096574e114e1a101e79a66107926d4d4389b77d6dbf5ecb0a2290f
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwg3xY6aZOOPIgzjbZgg3iqsOrsxi6WtOGzPQ9BDZMx:ku40ZTXEb2cu/O3g3b2gSqtrsmsGzPQo
TLSH
T1EA232B003BE8812BF2BE8F789DF26145867AF6732603D5491CC451DB5A23BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vnphimsexhay.blog:80
vnphimsexhay.blog:22
vnphimsexhay.blog:8080
vnphimsexhay.blog:8880
vnphimsexhay.blog:2052
vnphimsexhay.blog:2082
vnphimsexhay.blog:2086
vnphimsexhay.blog:2095
vnphimsexhay.blog:443
vnphimsexhay.blog:2053
vnphimsexhay.blog:2083
vnphimsexhay.blog:2087
vnphimsexhay.blog:2096
vnphimsexhay.blog:8443
www.vnphimsexhay.blog:80
www.vnphimsexhay.blog:22
www.vnphimsexhay.blog:8080
www.vnphimsexhay.blog:8880
www.vnphimsexhay.blog:2052
www.vnphimsexhay.blog:2082
www.vnphimsexhay.blog:2086
www.vnphimsexhay.blog:2095
www.vnphimsexhay.blog:443
www.vnphimsexhay.blog:2053
www.vnphimsexhay.blog:2083
www.vnphimsexhay.blog:2087
www.vnphimsexhay.blog:2096
www.vnphimsexhay.blog:8443
sodinokibi.vnphimsexhay.blog:80
sodinokibi.vnphimsexhay.blog:22
sodinokibi.vnphimsexhay.blog:8080
sodinokibi.vnphimsexhay.blog:8880
sodinokibi.vnphimsexhay.blog:2052
sodinokibi.vnphimsexhay.blog:2082
sodinokibi.vnphimsexhay.blog:2086
sodinokibi.vnphimsexhay.blog:2095
sodinokibi.vnphimsexhay.blog:443
sodinokibi.vnphimsexhay.blog:2053
sodinokibi.vnphimsexhay.blog:2083
sodinokibi.vnphimsexhay.blog:2087
sodinokibi.vnphimsexhay.blog:2096
sodinokibi.vnphimsexhay.blog:8443
nimda.vnphimsexhay.blog:80
nimda.vnphimsexhay.blog:22
nimda.vnphimsexhay.blog:8080
nimda.vnphimsexhay.blog:8880
nimda.vnphimsexhay.blog:2052
nimda.vnphimsexhay.blog:2082
nimda.vnphimsexhay.blog:2086
nimda.vnphimsexhay.blog:2095
nimda.vnphimsexhay.blog:443
nimda.vnphimsexhay.blog:2053
nimda.vnphimsexhay.blog:2083
nimda.vnphimsexhay.blog:2087
nimda.vnphimsexhay.blog:2096
nimda.vnphimsexhay.blog:8443
triton.vnphimsexhay.blog:80
triton.vnphimsexhay.blog:22
triton.vnphimsexhay.blog:8080
triton.vnphimsexhay.blog:8880
triton.vnphimsexhay.blog:2052
triton.vnphimsexhay.blog:2082
triton.vnphimsexhay.blog:2086
triton.vnphimsexhay.blog:2095
triton.vnphimsexhay.blog:443
triton.vnphimsexhay.blog:2053
triton.vnphimsexhay.blog:2083
triton.vnphimsexhay.blog:2087
triton.vnphimsexhay.blog:2096
triton.vnphimsexhay.blog:8443

Mutex

ZAKCHya1wsF8

Attributes

delay
0
install
true
install_file
o60bj.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  755c556434c44aeba78db4a882883c50a0dc25d096704005d4fa31145f4dcb25
- Size 45KB
- SHA256 755c556434c44aeba78db4a882883c50a0dc25d096704005d4fa31145f4dcb25
- MD5 d4819dc57db3f7021de3854cfe2e8a2c
- SHA1 06489c1188e085a5d7672726806c2e0a123bd1cd
- SHA512 45d61ae529536b17dd1b071526fb1e5e139dcdd0ec4f6feb0de397e18a2795a2738ff93b2e096574e114e1a101e79a66107926d4d4389b77d6dbf5ecb0a2290f
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwg3xY6aZOOPIgzjbZgg3iqsOrsxi6WtOGzPQ9BDZMx:ku40ZTXEb2cu/O3g3b2gSqtrsmsGzPQo
- TLSH
  T1EA232B003BE8812BF2BE8F789DF26145867AF6732603D5491CC451DB5A23BC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2