asyncrat | 1338588604e84523e1f70c3582ea662673e49d057c7f0a2df611f60361f9097d

Sharing

Copy URL Twitter E-mail

General

Target
1338588604e84523e1f70c3582ea662673e49d057c7f0a2df611f60361f9097d
Size 45KB
Sample260707-psyg6ah121
SHA256 1338588604e84523e1f70c3582ea662673e49d057c7f0a2df611f60361f9097d
MD5 0a32c1056db82d2f268087752541af04
SHA1 6a1b77f58c0f4ee0aac042eff8b2a8c74079536c
SHA512 241596ba4ac9e9ab7e1d418a4968c8e6712fe1032b288be396b038dcee584864ac8fb4398b7400feee3b36dc34a037eb02b83ffa186cecd389465b7505272636
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OFUwdrxIkDPICzjbsgX3iTpMXDHrBDZEx:MuBGJTPho2fqKTNMC3bjXSFMzddEx
TLSH
T19C232B003BE9C12BF2BE4F78ADF26145467AF5632603D5491C8451DB5B23FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

x.vnphimsexhay.blog:80
x.vnphimsexhay.blog:22
x.vnphimsexhay.blog:8080
x.vnphimsexhay.blog:8880
x.vnphimsexhay.blog:2052
x.vnphimsexhay.blog:2082
x.vnphimsexhay.blog:2086
x.vnphimsexhay.blog:2095
x.vnphimsexhay.blog:443
x.vnphimsexhay.blog:2053
x.vnphimsexhay.blog:2083
x.vnphimsexhay.blog:2087
x.vnphimsexhay.blog:2096
x.vnphimsexhay.blog:8443
www.x.vnphimsexhay.blog:80
www.x.vnphimsexhay.blog:22
www.x.vnphimsexhay.blog:8080
www.x.vnphimsexhay.blog:8880
www.x.vnphimsexhay.blog:2052
www.x.vnphimsexhay.blog:2082
www.x.vnphimsexhay.blog:2086
www.x.vnphimsexhay.blog:2095
www.x.vnphimsexhay.blog:443
www.x.vnphimsexhay.blog:2053
www.x.vnphimsexhay.blog:2083
www.x.vnphimsexhay.blog:2087
www.x.vnphimsexhay.blog:2096
www.x.vnphimsexhay.blog:8443
connect.x.vnphimsexhay.blog:80
connect.x.vnphimsexhay.blog:22
connect.x.vnphimsexhay.blog:8080
connect.x.vnphimsexhay.blog:8880
connect.x.vnphimsexhay.blog:2052
connect.x.vnphimsexhay.blog:2082
connect.x.vnphimsexhay.blog:2086
connect.x.vnphimsexhay.blog:2095
connect.x.vnphimsexhay.blog:443
connect.x.vnphimsexhay.blog:2053
connect.x.vnphimsexhay.blog:2083
connect.x.vnphimsexhay.blog:2087
connect.x.vnphimsexhay.blog:2096
connect.x.vnphimsexhay.blog:8443
ursnif.x.vnphimsexhay.blog:80
ursnif.x.vnphimsexhay.blog:22
ursnif.x.vnphimsexhay.blog:8080
ursnif.x.vnphimsexhay.blog:8880
ursnif.x.vnphimsexhay.blog:2052
ursnif.x.vnphimsexhay.blog:2082
ursnif.x.vnphimsexhay.blog:2086
ursnif.x.vnphimsexhay.blog:2095
ursnif.x.vnphimsexhay.blog:443
ursnif.x.vnphimsexhay.blog:2053
ursnif.x.vnphimsexhay.blog:2083
ursnif.x.vnphimsexhay.blog:2087
ursnif.x.vnphimsexhay.blog:2096
ursnif.x.vnphimsexhay.blog:8443

Mutex

S1THWWbQs0eb

Attributes

delay
0
install
true
install_file
wbm0.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1338588604e84523e1f70c3582ea662673e49d057c7f0a2df611f60361f9097d
- Size 45KB
- SHA256 1338588604e84523e1f70c3582ea662673e49d057c7f0a2df611f60361f9097d
- MD5 0a32c1056db82d2f268087752541af04
- SHA1 6a1b77f58c0f4ee0aac042eff8b2a8c74079536c
- SHA512 241596ba4ac9e9ab7e1d418a4968c8e6712fe1032b288be396b038dcee584864ac8fb4398b7400feee3b36dc34a037eb02b83ffa186cecd389465b7505272636
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OFUwdrxIkDPICzjbsgX3iTpMXDHrBDZEx:MuBGJTPho2fqKTNMC3bjXSFMzddEx
- TLSH
  T19C232B003BE9C12BF2BE4F78ADF26145467AF5632603D5491C8451DB5B23FC68A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2