asyncrat | 884d0fa9b4d5aad8ee6c4869a4d95eb0e54b0b41f8f4f314870dc89fd60c9916

Sharing

Copy URL Twitter E-mail

General

Target
884d0fa9b4d5aad8ee6c4869a4d95eb0e54b0b41f8f4f314870dc89fd60c9916
Size 45KB
Sample260707-nap8dsdx6k
SHA256 884d0fa9b4d5aad8ee6c4869a4d95eb0e54b0b41f8f4f314870dc89fd60c9916
MD5 3f647cc957cfc43730512b22287c3efc
SHA1 e52278782c57850c1488e23ee4d8d030dc281422
SHA512 8bdb6c97410a0ff991160e6d17caea419f10003f540be42d3d222cee2bc17f6a32bb1eae319e0c917c534f668267e47600e21147be9adce77e0c90d841faaf94
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1f0eUNEARViZPI6zjbWgF3iNifhn3lIMPZHBKVJBDZW:cuR0JTPjY2mUe+iW63bJFSch1bPZhuX0
TLSH
T1A1231A003BE8812BF2BE4B78A8F26145867BF6637603D6491CC451DB5713BC69A436EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vnphimsexhay.blog:80
vnphimsexhay.blog:22
vnphimsexhay.blog:8080
vnphimsexhay.blog:8880
vnphimsexhay.blog:2052
vnphimsexhay.blog:2082
vnphimsexhay.blog:2086
vnphimsexhay.blog:2095
vnphimsexhay.blog:443
vnphimsexhay.blog:2053
vnphimsexhay.blog:2083
vnphimsexhay.blog:2087
vnphimsexhay.blog:2096
vnphimsexhay.blog:8443
www.vnphimsexhay.blog:80
www.vnphimsexhay.blog:22
www.vnphimsexhay.blog:8080
www.vnphimsexhay.blog:8880
www.vnphimsexhay.blog:2052
www.vnphimsexhay.blog:2082
www.vnphimsexhay.blog:2086
www.vnphimsexhay.blog:2095
www.vnphimsexhay.blog:443
www.vnphimsexhay.blog:2053
www.vnphimsexhay.blog:2083
www.vnphimsexhay.blog:2087
www.vnphimsexhay.blog:2096
www.vnphimsexhay.blog:8443
wannacry.vnphimsexhay.blog:80
wannacry.vnphimsexhay.blog:22
wannacry.vnphimsexhay.blog:8080
wannacry.vnphimsexhay.blog:8880
wannacry.vnphimsexhay.blog:2052
wannacry.vnphimsexhay.blog:2082
wannacry.vnphimsexhay.blog:2086
wannacry.vnphimsexhay.blog:2095
wannacry.vnphimsexhay.blog:443
wannacry.vnphimsexhay.blog:2053
wannacry.vnphimsexhay.blog:2083
wannacry.vnphimsexhay.blog:2087
wannacry.vnphimsexhay.blog:2096
wannacry.vnphimsexhay.blog:8443
blacklotus.vnphimsexhay.blog:80
blacklotus.vnphimsexhay.blog:22
blacklotus.vnphimsexhay.blog:8080
blacklotus.vnphimsexhay.blog:8880
blacklotus.vnphimsexhay.blog:2052
blacklotus.vnphimsexhay.blog:2082
blacklotus.vnphimsexhay.blog:2086
blacklotus.vnphimsexhay.blog:2095
blacklotus.vnphimsexhay.blog:443
blacklotus.vnphimsexhay.blog:2053
blacklotus.vnphimsexhay.blog:2083
blacklotus.vnphimsexhay.blog:2087
blacklotus.vnphimsexhay.blog:2096
blacklotus.vnphimsexhay.blog:8443

Mutex

plV7BiPz0qrv

Attributes

delay
0
install
true
install_file
jf9i.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  884d0fa9b4d5aad8ee6c4869a4d95eb0e54b0b41f8f4f314870dc89fd60c9916
- Size 45KB
- SHA256 884d0fa9b4d5aad8ee6c4869a4d95eb0e54b0b41f8f4f314870dc89fd60c9916
- MD5 3f647cc957cfc43730512b22287c3efc
- SHA1 e52278782c57850c1488e23ee4d8d030dc281422
- SHA512 8bdb6c97410a0ff991160e6d17caea419f10003f540be42d3d222cee2bc17f6a32bb1eae319e0c917c534f668267e47600e21147be9adce77e0c90d841faaf94
- SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1f0eUNEARViZPI6zjbWgF3iNifhn3lIMPZHBKVJBDZW:cuR0JTPjY2mUe+iW63bJFSch1bPZhuX0
- TLSH
  T1A1231A003BE8812BF2BE4B78A8F26145867BF6637603D6491CC451DB5713BC69A436EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2