asyncrat | 6a3d057e0f649608c62289f8fab75864ce46a4b5483df67088fe14b25c50abca

Sharing

Copy URL Twitter E-mail

General

Target
6a3d057e0f649608c62289f8fab75864ce46a4b5483df67088fe14b25c50abca.exe
Size 45KB
Sample260710-lfjlpagy2q
SHA256 6a3d057e0f649608c62289f8fab75864ce46a4b5483df67088fe14b25c50abca
MD5 1c78ba276d2e5b3bb6195ee0d4fa52bc
SHA1 136c8de6dbbf73daf3781b9d123c5637fae89eb9
SHA512 11559d1ea1f3d85e389ba30d89ce0375e9ccdf165756b3563e078f861d826e78cfc6aa1f6b3c8d144242d1e88ad7155559a82b178e4b1d077943d23ac6f0e8d9
SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qryLiE0yFjrdjYkk8PIu6jbBgX3iBslsserUkP6Q84wW:ruKQpTAOX2FLBXQBuWbuXSwerUWo4md2
TLSH
T1B8232A0037E9C12BF6BE4F7899F26245867AF6636603D5491C8441CB5723FC68A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lophimsexviet.com:80
lophimsexviet.com:22
lophimsexviet.com:8080
lophimsexviet.com:8880
lophimsexviet.com:2052
lophimsexviet.com:2082
lophimsexviet.com:2086
lophimsexviet.com:2095
lophimsexviet.com:443
lophimsexviet.com:2053
lophimsexviet.com:2083
lophimsexviet.com:2087
lophimsexviet.com:2096
lophimsexviet.com:8443
www.lophimsexviet.com:80
www.lophimsexviet.com:22
www.lophimsexviet.com:8080
www.lophimsexviet.com:8880
www.lophimsexviet.com:2052
www.lophimsexviet.com:2082
www.lophimsexviet.com:2086
www.lophimsexviet.com:2095
www.lophimsexviet.com:443
www.lophimsexviet.com:2053
www.lophimsexviet.com:2083
www.lophimsexviet.com:2087
www.lophimsexviet.com:2096
www.lophimsexviet.com:8443
notpetya.lophimsexviet.com:80
notpetya.lophimsexviet.com:22
notpetya.lophimsexviet.com:8080
notpetya.lophimsexviet.com:8880
notpetya.lophimsexviet.com:2052
notpetya.lophimsexviet.com:2082
notpetya.lophimsexviet.com:2086
notpetya.lophimsexviet.com:2095
notpetya.lophimsexviet.com:443
notpetya.lophimsexviet.com:2053
notpetya.lophimsexviet.com:2083
notpetya.lophimsexviet.com:2087
notpetya.lophimsexviet.com:2096
notpetya.lophimsexviet.com:8443
nanocore.lophimsexviet.com:80
nanocore.lophimsexviet.com:22
nanocore.lophimsexviet.com:8080
nanocore.lophimsexviet.com:8880
nanocore.lophimsexviet.com:2052
nanocore.lophimsexviet.com:2082
nanocore.lophimsexviet.com:2086
nanocore.lophimsexviet.com:2095
nanocore.lophimsexviet.com:443
nanocore.lophimsexviet.com:2053
nanocore.lophimsexviet.com:2083
nanocore.lophimsexviet.com:2087
nanocore.lophimsexviet.com:2096
nanocore.lophimsexviet.com:8443
zeus.lophimsexviet.com:80
zeus.lophimsexviet.com:22
zeus.lophimsexviet.com:8080
zeus.lophimsexviet.com:8880
zeus.lophimsexviet.com:2052
zeus.lophimsexviet.com:2082
zeus.lophimsexviet.com:2086
zeus.lophimsexviet.com:2095
zeus.lophimsexviet.com:443
zeus.lophimsexviet.com:2053
zeus.lophimsexviet.com:2083
zeus.lophimsexviet.com:2087
zeus.lophimsexviet.com:2096
zeus.lophimsexviet.com:8443
blacklotus.lophimsexviet.com:80
blacklotus.lophimsexviet.com:22
blacklotus.lophimsexviet.com:8080
blacklotus.lophimsexviet.com:8880
blacklotus.lophimsexviet.com:2052
blacklotus.lophimsexviet.com:2082
blacklotus.lophimsexviet.com:2086
blacklotus.lophimsexviet.com:2095
blacklotus.lophimsexviet.com:443
blacklotus.lophimsexviet.com:2053
blacklotus.lophimsexviet.com:2083
blacklotus.lophimsexviet.com:2087
blacklotus.lophimsexviet.com:2096
blacklotus.lophimsexviet.com:8443

Mutex

OxBmpuHjaXRN

Attributes

delay
0
install
true
install_file
tuy7.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6a3d057e0f649608c62289f8fab75864ce46a4b5483df67088fe14b25c50abca.exe
- Size 45KB
- SHA256 6a3d057e0f649608c62289f8fab75864ce46a4b5483df67088fe14b25c50abca
- MD5 1c78ba276d2e5b3bb6195ee0d4fa52bc
- SHA1 136c8de6dbbf73daf3781b9d123c5637fae89eb9
- SHA512 11559d1ea1f3d85e389ba30d89ce0375e9ccdf165756b3563e078f861d826e78cfc6aa1f6b3c8d144242d1e88ad7155559a82b178e4b1d077943d23ac6f0e8d9
- SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qryLiE0yFjrdjYkk8PIu6jbBgX3iBslsserUkP6Q84wW:ruKQpTAOX2FLBXQBuWbuXSwerUWo4md2
- TLSH
  T1B8232A0037E9C12BF6BE4F7899F26245867AF6636603D5491C8441CB5723FC68A43AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2