asyncrat | 1d0d1cd06fecb26b6b9c330bf77a3ec4f18154858b74f5c2a5b8e0ecd1ff7c8b

Sharing

Copy URL Twitter E-mail

General

Target
1d0d1cd06fecb26b6b9c330bf77a3ec4f18154858b74f5c2a5b8e0ecd1ff7c8b
Size 45KB
Sample260710-t2tyjscz2m
SHA256 1d0d1cd06fecb26b6b9c330bf77a3ec4f18154858b74f5c2a5b8e0ecd1ff7c8b
MD5 8fcb398f2c603596ee0783342b46e317
SHA1 d38a4f9632a1b508774b14aa94f6f5c790aae539
SHA512 9e462591de35753d09f51ae1d3e04c8ab43d2bbd305bf560c8fcef11afbbbbffd6029d4dbb68fc078a82ff602c196de8bd319da1dc22db2f8d02a96360c20365
SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbUHO9YjoHPICYzjbVgX3i3ALzrI2R2RuBDZcx:Du2M5TQif2K6kgCY3byXS89ARgdcx
TLSH
T1F7230A003BE9812BF2BE4FB8A9F26145867AF6633A03D5491CC441D75613FC6CA42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lophimsexviet.com:80
lophimsexviet.com:22
lophimsexviet.com:8080
lophimsexviet.com:8880
lophimsexviet.com:2052
lophimsexviet.com:2082
lophimsexviet.com:2086
lophimsexviet.com:2095
lophimsexviet.com:443
lophimsexviet.com:2053
lophimsexviet.com:2083
lophimsexviet.com:2087
lophimsexviet.com:2096
lophimsexviet.com:8443
www.lophimsexviet.com:80
www.lophimsexviet.com:22
www.lophimsexviet.com:8080
www.lophimsexviet.com:8880
www.lophimsexviet.com:2052
www.lophimsexviet.com:2082
www.lophimsexviet.com:2086
www.lophimsexviet.com:2095
www.lophimsexviet.com:443
www.lophimsexviet.com:2053
www.lophimsexviet.com:2083
www.lophimsexviet.com:2087
www.lophimsexviet.com:2096
www.lophimsexviet.com:8443
formbook.lophimsexviet.com:80
formbook.lophimsexviet.com:22
formbook.lophimsexviet.com:8080
formbook.lophimsexviet.com:8880
formbook.lophimsexviet.com:2052
formbook.lophimsexviet.com:2082
formbook.lophimsexviet.com:2086
formbook.lophimsexviet.com:2095
formbook.lophimsexviet.com:443
formbook.lophimsexviet.com:2053
formbook.lophimsexviet.com:2083
formbook.lophimsexviet.com:2087
formbook.lophimsexviet.com:2096
formbook.lophimsexviet.com:8443
industroyer.lophimsexviet.com:80
industroyer.lophimsexviet.com:22
industroyer.lophimsexviet.com:8080
industroyer.lophimsexviet.com:8880
industroyer.lophimsexviet.com:2052
industroyer.lophimsexviet.com:2082
industroyer.lophimsexviet.com:2086
industroyer.lophimsexviet.com:2095
industroyer.lophimsexviet.com:443
industroyer.lophimsexviet.com:2053
industroyer.lophimsexviet.com:2083
industroyer.lophimsexviet.com:2087
industroyer.lophimsexviet.com:2096
industroyer.lophimsexviet.com:8443
nanocore.lophimsexviet.com:80
nanocore.lophimsexviet.com:22
nanocore.lophimsexviet.com:8080
nanocore.lophimsexviet.com:8880
nanocore.lophimsexviet.com:2052
nanocore.lophimsexviet.com:2082
nanocore.lophimsexviet.com:2086
nanocore.lophimsexviet.com:2095
nanocore.lophimsexviet.com:443
nanocore.lophimsexviet.com:2053
nanocore.lophimsexviet.com:2083
nanocore.lophimsexviet.com:2087
nanocore.lophimsexviet.com:2096
nanocore.lophimsexviet.com:8443
triton.lophimsexviet.com:80
triton.lophimsexviet.com:22
triton.lophimsexviet.com:8080
triton.lophimsexviet.com:8880
triton.lophimsexviet.com:2052
triton.lophimsexviet.com:2082
triton.lophimsexviet.com:2086
triton.lophimsexviet.com:2095
triton.lophimsexviet.com:443
triton.lophimsexviet.com:2053
triton.lophimsexviet.com:2083
triton.lophimsexviet.com:2087
triton.lophimsexviet.com:2096
triton.lophimsexviet.com:8443

Mutex

CUNDG7filI9E

Attributes

delay
0
install
true
install_file
8rau1z.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1d0d1cd06fecb26b6b9c330bf77a3ec4f18154858b74f5c2a5b8e0ecd1ff7c8b
- Size 45KB
- SHA256 1d0d1cd06fecb26b6b9c330bf77a3ec4f18154858b74f5c2a5b8e0ecd1ff7c8b
- MD5 8fcb398f2c603596ee0783342b46e317
- SHA1 d38a4f9632a1b508774b14aa94f6f5c790aae539
- SHA512 9e462591de35753d09f51ae1d3e04c8ab43d2bbd305bf560c8fcef11afbbbbffd6029d4dbb68fc078a82ff602c196de8bd319da1dc22db2f8d02a96360c20365
- SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbUHO9YjoHPICYzjbVgX3i3ALzrI2R2RuBDZcx:Du2M5TQif2K6kgCY3byXS89ARgdcx
- TLSH
  T1F7230A003BE9812BF2BE4FB8A9F26145867AF6633A03D5491CC441D75613FC6CA42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2