asyncrat | 8e10c63a68412d2140195e87762a4d6c934b574c7f89704aaad39356229d3b55

Sharing

Copy URL Twitter E-mail

General

Target
8e10c63a68412d2140195e87762a4d6c934b574c7f89704aaad39356229d3b55
Size 45KB
Sample260710-phj7sabv4n
SHA256 8e10c63a68412d2140195e87762a4d6c934b574c7f89704aaad39356229d3b55
MD5 0bd76f814f6bd32e9e70ae8c9f858f92
SHA1 17f9a4baf665cdbc4b5f49029d492184f2cc2988
SHA512 3ca2567912d2e5b01a97c6f67f935f4d226441a1743c564f1a1bdf929d1aba848154ea79b3255685909606e37b18eb4a10bf91753a584ff68460326c7447723f
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7h/cYssPJZOPIcvzjbpgXqiTEAPBb0XvU7iYy9mqe:0ushJTDXgH20MIf3cv3bmXTTJ081y/d+
TLSH
T1B9231B0037E8C12BF2BE4F7898F26146867AF6673603E58E1CC451975A13FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lophimsexviet.com:80
lophimsexviet.com:22
lophimsexviet.com:8080
lophimsexviet.com:8880
lophimsexviet.com:2052
lophimsexviet.com:2082
lophimsexviet.com:2086
lophimsexviet.com:2095
lophimsexviet.com:443
lophimsexviet.com:2053
lophimsexviet.com:2083
lophimsexviet.com:2087
lophimsexviet.com:2096
lophimsexviet.com:8443
www.lophimsexviet.com:80
www.lophimsexviet.com:22
www.lophimsexviet.com:8080
www.lophimsexviet.com:8880
www.lophimsexviet.com:2052
www.lophimsexviet.com:2082
www.lophimsexviet.com:2086
www.lophimsexviet.com:2095
www.lophimsexviet.com:443
www.lophimsexviet.com:2053
www.lophimsexviet.com:2083
www.lophimsexviet.com:2087
www.lophimsexviet.com:2096
www.lophimsexviet.com:8443
conti.lophimsexviet.com:80
conti.lophimsexviet.com:22
conti.lophimsexviet.com:8080
conti.lophimsexviet.com:8880
conti.lophimsexviet.com:2052
conti.lophimsexviet.com:2082
conti.lophimsexviet.com:2086
conti.lophimsexviet.com:2095
conti.lophimsexviet.com:443
conti.lophimsexviet.com:2053
conti.lophimsexviet.com:2083
conti.lophimsexviet.com:2087
conti.lophimsexviet.com:2096
conti.lophimsexviet.com:8443
formbook.lophimsexviet.com:80
formbook.lophimsexviet.com:22
formbook.lophimsexviet.com:8080
formbook.lophimsexviet.com:8880
formbook.lophimsexviet.com:2052
formbook.lophimsexviet.com:2082
formbook.lophimsexviet.com:2086
formbook.lophimsexviet.com:2095
formbook.lophimsexviet.com:443
formbook.lophimsexviet.com:2053
formbook.lophimsexviet.com:2083
formbook.lophimsexviet.com:2087
formbook.lophimsexviet.com:2096
formbook.lophimsexviet.com:8443
qakbot.lophimsexviet.com:80
qakbot.lophimsexviet.com:22
qakbot.lophimsexviet.com:8080
qakbot.lophimsexviet.com:8880
qakbot.lophimsexviet.com:2052
qakbot.lophimsexviet.com:2082
qakbot.lophimsexviet.com:2086
qakbot.lophimsexviet.com:2095
qakbot.lophimsexviet.com:443
qakbot.lophimsexviet.com:2053
qakbot.lophimsexviet.com:2083
qakbot.lophimsexviet.com:2087
qakbot.lophimsexviet.com:2096
qakbot.lophimsexviet.com:8443
remote.lophimsexviet.com:80
remote.lophimsexviet.com:22
remote.lophimsexviet.com:8080
remote.lophimsexviet.com:8880
remote.lophimsexviet.com:2052
remote.lophimsexviet.com:2082
remote.lophimsexviet.com:2086
remote.lophimsexviet.com:2095
remote.lophimsexviet.com:443
remote.lophimsexviet.com:2053
remote.lophimsexviet.com:2083
remote.lophimsexviet.com:2087
remote.lophimsexviet.com:2096
remote.lophimsexviet.com:8443

Mutex

gFH2hX3xxQF0

Attributes

delay
0
install
true
install_file
qwjntq.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  8e10c63a68412d2140195e87762a4d6c934b574c7f89704aaad39356229d3b55
- Size 45KB
- SHA256 8e10c63a68412d2140195e87762a4d6c934b574c7f89704aaad39356229d3b55
- MD5 0bd76f814f6bd32e9e70ae8c9f858f92
- SHA1 17f9a4baf665cdbc4b5f49029d492184f2cc2988
- SHA512 3ca2567912d2e5b01a97c6f67f935f4d226441a1743c564f1a1bdf929d1aba848154ea79b3255685909606e37b18eb4a10bf91753a584ff68460326c7447723f
- SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7h/cYssPJZOPIcvzjbpgXqiTEAPBb0XvU7iYy9mqe:0ushJTDXgH20MIf3cv3bmXTTJ081y/d+
- TLSH
  T1B9231B0037E8C12BF2BE4F7898F26146867AF6673603E58E1CC451975A13FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2