asyncrat | 2f37a85ce8373c53e5cce99d0ef2fb7e3900e5a33638b713504ce5ad32709c9b

Sharing

Copy URL Twitter E-mail

General

Target
2f37a85ce8373c53e5cce99d0ef2fb7e3900e5a33638b713504ce5ad32709c9b
Size 45KB
Sample260710-sxdv4ab18q
SHA256 2f37a85ce8373c53e5cce99d0ef2fb7e3900e5a33638b713504ce5ad32709c9b
MD5 ccb1d259128abcb0466476b2db68dc9e
SHA1 8710d2632cdffc8b8fe683fda5ba8e7acde40c45
SHA512 501e7ee312afb4571fa195f5f15d0f728609d4fc15192193c65f2d66def994b62e0227d0482831459e4bb404a74a15733e66fa248290835c551e3437c7222fa7
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYNxQHJcOPIcUzjb7gG3iXg7nCcr2FBDZ0x:8uuSpTgyf27sW3cU3bEGSqCcr2Ld0x
TLSH
T1FA232B003BE8822BF2BE4FB89DF26145867AA6637603D54A1CC441DB5713FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vnphimsexhay.blog:80
vnphimsexhay.blog:22
vnphimsexhay.blog:8080
vnphimsexhay.blog:8880
vnphimsexhay.blog:2052
vnphimsexhay.blog:2082
vnphimsexhay.blog:2086
vnphimsexhay.blog:2095
vnphimsexhay.blog:443
vnphimsexhay.blog:2053
vnphimsexhay.blog:2083
vnphimsexhay.blog:2087
vnphimsexhay.blog:2096
vnphimsexhay.blog:8443
www.vnphimsexhay.blog:80
www.vnphimsexhay.blog:22
www.vnphimsexhay.blog:8080
www.vnphimsexhay.blog:8880
www.vnphimsexhay.blog:2052
www.vnphimsexhay.blog:2082
www.vnphimsexhay.blog:2086
www.vnphimsexhay.blog:2095
www.vnphimsexhay.blog:443
www.vnphimsexhay.blog:2053
www.vnphimsexhay.blog:2083
www.vnphimsexhay.blog:2087
www.vnphimsexhay.blog:2096
www.vnphimsexhay.blog:8443
mirai.vnphimsexhay.blog:80
mirai.vnphimsexhay.blog:22
mirai.vnphimsexhay.blog:8080
mirai.vnphimsexhay.blog:8880
mirai.vnphimsexhay.blog:2052
mirai.vnphimsexhay.blog:2082
mirai.vnphimsexhay.blog:2086
mirai.vnphimsexhay.blog:2095
mirai.vnphimsexhay.blog:443
mirai.vnphimsexhay.blog:2053
mirai.vnphimsexhay.blog:2083
mirai.vnphimsexhay.blog:2087
mirai.vnphimsexhay.blog:2096
mirai.vnphimsexhay.blog:8443
ryuk.vnphimsexhay.blog:80
ryuk.vnphimsexhay.blog:22
ryuk.vnphimsexhay.blog:8080
ryuk.vnphimsexhay.blog:8880
ryuk.vnphimsexhay.blog:2052
ryuk.vnphimsexhay.blog:2082
ryuk.vnphimsexhay.blog:2086
ryuk.vnphimsexhay.blog:2095
ryuk.vnphimsexhay.blog:443
ryuk.vnphimsexhay.blog:2053
ryuk.vnphimsexhay.blog:2083
ryuk.vnphimsexhay.blog:2087
ryuk.vnphimsexhay.blog:2096
ryuk.vnphimsexhay.blog:8443
codered.vnphimsexhay.blog:80
codered.vnphimsexhay.blog:22
codered.vnphimsexhay.blog:8080
codered.vnphimsexhay.blog:8880
codered.vnphimsexhay.blog:2052
codered.vnphimsexhay.blog:2082
codered.vnphimsexhay.blog:2086
codered.vnphimsexhay.blog:2095
codered.vnphimsexhay.blog:443
codered.vnphimsexhay.blog:2053
codered.vnphimsexhay.blog:2083
codered.vnphimsexhay.blog:2087
codered.vnphimsexhay.blog:2096
codered.vnphimsexhay.blog:8443

Mutex

GUXcuemPlXt7

Attributes

delay
0
install
true
install_file
ku08cn.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2f37a85ce8373c53e5cce99d0ef2fb7e3900e5a33638b713504ce5ad32709c9b
- Size 45KB
- SHA256 2f37a85ce8373c53e5cce99d0ef2fb7e3900e5a33638b713504ce5ad32709c9b
- MD5 ccb1d259128abcb0466476b2db68dc9e
- SHA1 8710d2632cdffc8b8fe683fda5ba8e7acde40c45
- SHA512 501e7ee312afb4571fa195f5f15d0f728609d4fc15192193c65f2d66def994b62e0227d0482831459e4bb404a74a15733e66fa248290835c551e3437c7222fa7
- SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYNxQHJcOPIcUzjb7gG3iXg7nCcr2FBDZ0x:8uuSpTgyf27sW3cU3bEGSqCcr2Ld0x
- TLSH
  T1FA232B003BE8822BF2BE4FB89DF26145867AA6637603D54A1CC441DB5713FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2