asyncrat | 7b014c3857e3f87fc91f072c9d87740cf1a66b21d1af2fec922f99c18d31f2c1

Sharing

Copy URL Twitter E-mail

General

Target
7b014c3857e3f87fc91f072c9d87740cf1a66b21d1af2fec922f99c18d31f2c1
Size 45KB
Sample260710-l89nksas91
SHA256 7b014c3857e3f87fc91f072c9d87740cf1a66b21d1af2fec922f99c18d31f2c1
MD5 a15031016d62d34dc68d33e69a424371
SHA1 6d71c1d5c7b5b4d580545cff4120d744a88d1ae7
SHA512 9e1e5a91c5c7ac7b37a701223dbab92afc93d44412692abb4654786360847ecf714ec8dc72f6dd8a16ff8cd735a2ede28b607d7666b7d98e9bf1f5184b1c2d02
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAMHUttXAPIMzjbegX3m7+fU4RSuJpBDZcx:UuKWgSJTwRf280rXlM3bhXWKfBRldcx
TLSH
T17C232A1037ECC12BF2BF4F78A9F26145467AF2637603DA492CC4519B5623FC29A426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lophimsexviet.com:80
lophimsexviet.com:22
lophimsexviet.com:8080
lophimsexviet.com:8880
lophimsexviet.com:2052
lophimsexviet.com:2082
lophimsexviet.com:2086
lophimsexviet.com:2095
lophimsexviet.com:443
lophimsexviet.com:2053
lophimsexviet.com:2083
lophimsexviet.com:2087
lophimsexviet.com:2096
lophimsexviet.com:8443
www.lophimsexviet.com:80
www.lophimsexviet.com:22
www.lophimsexviet.com:8080
www.lophimsexviet.com:8880
www.lophimsexviet.com:2052
www.lophimsexviet.com:2082
www.lophimsexviet.com:2086
www.lophimsexviet.com:2095
www.lophimsexviet.com:443
www.lophimsexviet.com:2053
www.lophimsexviet.com:2083
www.lophimsexviet.com:2087
www.lophimsexviet.com:2096
www.lophimsexviet.com:8443
blaster.lophimsexviet.com:80
blaster.lophimsexviet.com:22
blaster.lophimsexviet.com:8080
blaster.lophimsexviet.com:8880
blaster.lophimsexviet.com:2052
blaster.lophimsexviet.com:2082
blaster.lophimsexviet.com:2086
blaster.lophimsexviet.com:2095
blaster.lophimsexviet.com:443
blaster.lophimsexviet.com:2053
blaster.lophimsexviet.com:2083
blaster.lophimsexviet.com:2087
blaster.lophimsexviet.com:2096
blaster.lophimsexviet.com:8443
client.lophimsexviet.com:80
client.lophimsexviet.com:22
client.lophimsexviet.com:8080
client.lophimsexviet.com:8880
client.lophimsexviet.com:2052
client.lophimsexviet.com:2082
client.lophimsexviet.com:2086
client.lophimsexviet.com:2095
client.lophimsexviet.com:443
client.lophimsexviet.com:2053
client.lophimsexviet.com:2083
client.lophimsexviet.com:2087
client.lophimsexviet.com:2096
client.lophimsexviet.com:8443
zeus.lophimsexviet.com:80
zeus.lophimsexviet.com:22
zeus.lophimsexviet.com:8080
zeus.lophimsexviet.com:8880
zeus.lophimsexviet.com:2052
zeus.lophimsexviet.com:2082
zeus.lophimsexviet.com:2086
zeus.lophimsexviet.com:2095
zeus.lophimsexviet.com:443
zeus.lophimsexviet.com:2053
zeus.lophimsexviet.com:2083
zeus.lophimsexviet.com:2087
zeus.lophimsexviet.com:2096
zeus.lophimsexviet.com:8443

Mutex

Do8kUmg2X5B6

Attributes

delay
0
install
true
install_file
rym1rias.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  7b014c3857e3f87fc91f072c9d87740cf1a66b21d1af2fec922f99c18d31f2c1
- Size 45KB
- SHA256 7b014c3857e3f87fc91f072c9d87740cf1a66b21d1af2fec922f99c18d31f2c1
- MD5 a15031016d62d34dc68d33e69a424371
- SHA1 6d71c1d5c7b5b4d580545cff4120d744a88d1ae7
- SHA512 9e1e5a91c5c7ac7b37a701223dbab92afc93d44412692abb4654786360847ecf714ec8dc72f6dd8a16ff8cd735a2ede28b607d7666b7d98e9bf1f5184b1c2d02
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAMHUttXAPIMzjbegX3m7+fU4RSuJpBDZcx:UuKWgSJTwRf280rXlM3bhXWKfBRldcx
- TLSH
  T17C232A1037ECC12BF2BF4F78A9F26145467AF2637603DA492CC4519B5623FC29A426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2