asyncrat | 4419440ed029e0e862b0c3d5d2faa090e81e1f53d117a0faf99ffc7467e98a1d

Sharing

Copy URL Twitter E-mail

General

Target
4419440ed029e0e862b0c3d5d2faa090e81e1f53d117a0faf99ffc7467e98a1d
Size 45KB
Sample260707-v2w9caax2v
SHA256 4419440ed029e0e862b0c3d5d2faa090e81e1f53d117a0faf99ffc7467e98a1d
MD5 2b2cdf6d00540e0fd315e20864df8d7e
SHA1 baddd4460e39498d9fb03f64a5436f667a56883a
SHA512 07f2a0323108ee93619f31ee8d69df4db9481e60c9ff2468f481c1b5dfb3a4636b56ce36ac728706421965e625a3212148308a5c731d1cc5ace5d4db0badf30f
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1yp7EcPIpzjbggX3i+oKC0mQzXUoFnBDZEx:MuBGJTPho2t8V41Ehp3bHXS5KNbkofdG
TLSH
T1A6232A0037E8823BF2BE4F78ADF26245867AF6732603D64E1CC4519B5613BC696426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

x.vnphimsexhay.blog:80
x.vnphimsexhay.blog:22
x.vnphimsexhay.blog:8080
x.vnphimsexhay.blog:8880
x.vnphimsexhay.blog:2052
x.vnphimsexhay.blog:2082
x.vnphimsexhay.blog:2086
x.vnphimsexhay.blog:2095
x.vnphimsexhay.blog:443
x.vnphimsexhay.blog:2053
x.vnphimsexhay.blog:2083
x.vnphimsexhay.blog:2087
x.vnphimsexhay.blog:2096
x.vnphimsexhay.blog:8443
www.x.vnphimsexhay.blog:80
www.x.vnphimsexhay.blog:22
www.x.vnphimsexhay.blog:8080
www.x.vnphimsexhay.blog:8880
www.x.vnphimsexhay.blog:2052
www.x.vnphimsexhay.blog:2082
www.x.vnphimsexhay.blog:2086
www.x.vnphimsexhay.blog:2095
www.x.vnphimsexhay.blog:443
www.x.vnphimsexhay.blog:2053
www.x.vnphimsexhay.blog:2083
www.x.vnphimsexhay.blog:2087
www.x.vnphimsexhay.blog:2096
www.x.vnphimsexhay.blog:8443
zeus.x.vnphimsexhay.blog:80
zeus.x.vnphimsexhay.blog:22
zeus.x.vnphimsexhay.blog:8080
zeus.x.vnphimsexhay.blog:8880
zeus.x.vnphimsexhay.blog:2052
zeus.x.vnphimsexhay.blog:2082
zeus.x.vnphimsexhay.blog:2086
zeus.x.vnphimsexhay.blog:2095
zeus.x.vnphimsexhay.blog:443
zeus.x.vnphimsexhay.blog:2053
zeus.x.vnphimsexhay.blog:2083
zeus.x.vnphimsexhay.blog:2087
zeus.x.vnphimsexhay.blog:2096
zeus.x.vnphimsexhay.blog:8443
blaster.x.vnphimsexhay.blog:80
blaster.x.vnphimsexhay.blog:22
blaster.x.vnphimsexhay.blog:8080
blaster.x.vnphimsexhay.blog:8880
blaster.x.vnphimsexhay.blog:2052
blaster.x.vnphimsexhay.blog:2082
blaster.x.vnphimsexhay.blog:2086
blaster.x.vnphimsexhay.blog:2095
blaster.x.vnphimsexhay.blog:443
blaster.x.vnphimsexhay.blog:2053
blaster.x.vnphimsexhay.blog:2083
blaster.x.vnphimsexhay.blog:2087
blaster.x.vnphimsexhay.blog:2096
blaster.x.vnphimsexhay.blog:8443

Mutex

Uka97kd32sG5

Attributes

delay
0
install
true
install_file
rfuw.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4419440ed029e0e862b0c3d5d2faa090e81e1f53d117a0faf99ffc7467e98a1d
- Size 45KB
- SHA256 4419440ed029e0e862b0c3d5d2faa090e81e1f53d117a0faf99ffc7467e98a1d
- MD5 2b2cdf6d00540e0fd315e20864df8d7e
- SHA1 baddd4460e39498d9fb03f64a5436f667a56883a
- SHA512 07f2a0323108ee93619f31ee8d69df4db9481e60c9ff2468f481c1b5dfb3a4636b56ce36ac728706421965e625a3212148308a5c731d1cc5ace5d4db0badf30f
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1yp7EcPIpzjbggX3i+oKC0mQzXUoFnBDZEx:MuBGJTPho2t8V41Ehp3bHXS5KNbkofdG
- TLSH
  T1A6232A0037E8823BF2BE4F78ADF26245867AF6732603D64E1CC4519B5613BC696426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2