asyncrat | c5d3543104ccd31cdec53045ded592a954947c1b0edb28a6a8f23138a9437864

Sharing

Copy URL Twitter E-mail

General

Target
c5d3543104ccd31cdec53045ded592a954947c1b0edb28a6a8f23138a9437864
Size 45KB
Sample260707-lnjawsbz5q
SHA256 c5d3543104ccd31cdec53045ded592a954947c1b0edb28a6a8f23138a9437864
MD5 3c3f2163694c9eb201e4c89185388628
SHA1 6876d855165d23c325ae9988bc6bde1d6e2c9066
SHA512 1b7c530f752f61db9ecc8be14f669f2e1e0285ad4566203dec8cb2da0eb6973dfafeae46f6e41d0645ba2bc015671d6e111efd0297715be59992f936a21cadcb
SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMITnyfaaPIwzjbVgX3i2sOd//3sGz+PX5DQ8YBDZ+:0u2vpTDe+2FEhw3byXS2RdH3NWQBd8x
TLSH
T199231A0037E9812BF2BE4F789DF26145867AF6633603D6891CC411DB5713BC68A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vnphimsexhay.blog:80
vnphimsexhay.blog:22
vnphimsexhay.blog:8080
vnphimsexhay.blog:8880
vnphimsexhay.blog:2052
vnphimsexhay.blog:2082
vnphimsexhay.blog:2086
vnphimsexhay.blog:2095
vnphimsexhay.blog:443
vnphimsexhay.blog:2053
vnphimsexhay.blog:2083
vnphimsexhay.blog:2087
vnphimsexhay.blog:2096
vnphimsexhay.blog:8443
www.vnphimsexhay.blog:80
www.vnphimsexhay.blog:22
www.vnphimsexhay.blog:8080
www.vnphimsexhay.blog:8880
www.vnphimsexhay.blog:2052
www.vnphimsexhay.blog:2082
www.vnphimsexhay.blog:2086
www.vnphimsexhay.blog:2095
www.vnphimsexhay.blog:443
www.vnphimsexhay.blog:2053
www.vnphimsexhay.blog:2083
www.vnphimsexhay.blog:2087
www.vnphimsexhay.blog:2096
www.vnphimsexhay.blog:8443
remote.vnphimsexhay.blog:80
remote.vnphimsexhay.blog:22
remote.vnphimsexhay.blog:8080
remote.vnphimsexhay.blog:8880
remote.vnphimsexhay.blog:2052
remote.vnphimsexhay.blog:2082
remote.vnphimsexhay.blog:2086
remote.vnphimsexhay.blog:2095
remote.vnphimsexhay.blog:443
remote.vnphimsexhay.blog:2053
remote.vnphimsexhay.blog:2083
remote.vnphimsexhay.blog:2087
remote.vnphimsexhay.blog:2096
remote.vnphimsexhay.blog:8443
rat.vnphimsexhay.blog:80
rat.vnphimsexhay.blog:22
rat.vnphimsexhay.blog:8080
rat.vnphimsexhay.blog:8880
rat.vnphimsexhay.blog:2052
rat.vnphimsexhay.blog:2082
rat.vnphimsexhay.blog:2086
rat.vnphimsexhay.blog:2095
rat.vnphimsexhay.blog:443
rat.vnphimsexhay.blog:2053
rat.vnphimsexhay.blog:2083
rat.vnphimsexhay.blog:2087
rat.vnphimsexhay.blog:2096
rat.vnphimsexhay.blog:8443
cl0p.vnphimsexhay.blog:80
cl0p.vnphimsexhay.blog:22
cl0p.vnphimsexhay.blog:8080
cl0p.vnphimsexhay.blog:8880
cl0p.vnphimsexhay.blog:2052
cl0p.vnphimsexhay.blog:2082
cl0p.vnphimsexhay.blog:2086
cl0p.vnphimsexhay.blog:2095
cl0p.vnphimsexhay.blog:443
cl0p.vnphimsexhay.blog:2053
cl0p.vnphimsexhay.blog:2083
cl0p.vnphimsexhay.blog:2087
cl0p.vnphimsexhay.blog:2096
cl0p.vnphimsexhay.blog:8443
downadup.vnphimsexhay.blog:80
downadup.vnphimsexhay.blog:22
downadup.vnphimsexhay.blog:8080
downadup.vnphimsexhay.blog:8880
downadup.vnphimsexhay.blog:2052
downadup.vnphimsexhay.blog:2082
downadup.vnphimsexhay.blog:2086
downadup.vnphimsexhay.blog:2095
downadup.vnphimsexhay.blog:443
downadup.vnphimsexhay.blog:2053
downadup.vnphimsexhay.blog:2083
downadup.vnphimsexhay.blog:2087
downadup.vnphimsexhay.blog:2096
downadup.vnphimsexhay.blog:8443

Mutex

1ZB7HF8VZk8C

Attributes

delay
0
install
true
install_file
4z2ccp3.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c5d3543104ccd31cdec53045ded592a954947c1b0edb28a6a8f23138a9437864
- Size 45KB
- SHA256 c5d3543104ccd31cdec53045ded592a954947c1b0edb28a6a8f23138a9437864
- MD5 3c3f2163694c9eb201e4c89185388628
- SHA1 6876d855165d23c325ae9988bc6bde1d6e2c9066
- SHA512 1b7c530f752f61db9ecc8be14f669f2e1e0285ad4566203dec8cb2da0eb6973dfafeae46f6e41d0645ba2bc015671d6e111efd0297715be59992f936a21cadcb
- SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMITnyfaaPIwzjbVgX3i2sOd//3sGz+PX5DQ8YBDZ+:0u2vpTDe+2FEhw3byXS2RdH3NWQBd8x
- TLSH
  T199231A0037E9812BF2BE4F789DF26145867AF6633603D6891CC411DB5713BC68A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2