asyncrat | 24c5d0e318e5c46c7f22acf8adadb18ae88f0084c25be1ec54dc629da39dcc5c

Sharing

Copy URL Twitter E-mail

General

Target
24c5d0e318e5c46c7f22acf8adadb18ae88f0084c25be1ec54dc629da39dcc5c
Size 45KB
Sample260710-th4nmscw4j
SHA256 24c5d0e318e5c46c7f22acf8adadb18ae88f0084c25be1ec54dc629da39dcc5c
MD5 9b8cb12da292b949f4139b18a855ac4c
SHA1 2223f725e6f88865503c76746e4363563e0a3a1a
SHA512 da6fe30899877255df8da9d722de30ee61ceb0d79b95e758c5fb3dddc811d33f0736ebc217df8edebc4904501ad70ada5c0ef860aae6fa65fb317273cbc8c0d7
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4wO5QPCBjPSNjPI/zjb0gX3ieE/6wJxBV56nBDZ0x:8uUIpT4vAj20O5sMSK/3bbXSeEd/md0x
TLSH
T175233A003BE9C12BF2BE5F7899F26145867AF6633603D54A1CC451DB4623FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vnphimsexhay.blog:80
vnphimsexhay.blog:22
vnphimsexhay.blog:8080
vnphimsexhay.blog:8880
vnphimsexhay.blog:2052
vnphimsexhay.blog:2082
vnphimsexhay.blog:2086
vnphimsexhay.blog:2095
vnphimsexhay.blog:443
vnphimsexhay.blog:2053
vnphimsexhay.blog:2083
vnphimsexhay.blog:2087
vnphimsexhay.blog:2096
vnphimsexhay.blog:8443
www.vnphimsexhay.blog:80
www.vnphimsexhay.blog:22
www.vnphimsexhay.blog:8080
www.vnphimsexhay.blog:8880
www.vnphimsexhay.blog:2052
www.vnphimsexhay.blog:2082
www.vnphimsexhay.blog:2086
www.vnphimsexhay.blog:2095
www.vnphimsexhay.blog:443
www.vnphimsexhay.blog:2053
www.vnphimsexhay.blog:2083
www.vnphimsexhay.blog:2087
www.vnphimsexhay.blog:2096
www.vnphimsexhay.blog:8443
shamoon.vnphimsexhay.blog:80
shamoon.vnphimsexhay.blog:22
shamoon.vnphimsexhay.blog:8080
shamoon.vnphimsexhay.blog:8880
shamoon.vnphimsexhay.blog:2052
shamoon.vnphimsexhay.blog:2082
shamoon.vnphimsexhay.blog:2086
shamoon.vnphimsexhay.blog:2095
shamoon.vnphimsexhay.blog:443
shamoon.vnphimsexhay.blog:2053
shamoon.vnphimsexhay.blog:2083
shamoon.vnphimsexhay.blog:2087
shamoon.vnphimsexhay.blog:2096
shamoon.vnphimsexhay.blog:8443
qakbot.vnphimsexhay.blog:80
qakbot.vnphimsexhay.blog:22
qakbot.vnphimsexhay.blog:8080
qakbot.vnphimsexhay.blog:8880
qakbot.vnphimsexhay.blog:2052
qakbot.vnphimsexhay.blog:2082
qakbot.vnphimsexhay.blog:2086
qakbot.vnphimsexhay.blog:2095
qakbot.vnphimsexhay.blog:443
qakbot.vnphimsexhay.blog:2053
qakbot.vnphimsexhay.blog:2083
qakbot.vnphimsexhay.blog:2087
qakbot.vnphimsexhay.blog:2096
qakbot.vnphimsexhay.blog:8443
gootloader.vnphimsexhay.blog:80
gootloader.vnphimsexhay.blog:22
gootloader.vnphimsexhay.blog:8080
gootloader.vnphimsexhay.blog:8880
gootloader.vnphimsexhay.blog:2052
gootloader.vnphimsexhay.blog:2082
gootloader.vnphimsexhay.blog:2086
gootloader.vnphimsexhay.blog:2095
gootloader.vnphimsexhay.blog:443
gootloader.vnphimsexhay.blog:2053
gootloader.vnphimsexhay.blog:2083
gootloader.vnphimsexhay.blog:2087
gootloader.vnphimsexhay.blog:2096
gootloader.vnphimsexhay.blog:8443

Mutex

e9WSEYXr5rSR

Attributes

delay
0
install
true
install_file
pihou4w.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  24c5d0e318e5c46c7f22acf8adadb18ae88f0084c25be1ec54dc629da39dcc5c
- Size 45KB
- SHA256 24c5d0e318e5c46c7f22acf8adadb18ae88f0084c25be1ec54dc629da39dcc5c
- MD5 9b8cb12da292b949f4139b18a855ac4c
- SHA1 2223f725e6f88865503c76746e4363563e0a3a1a
- SHA512 da6fe30899877255df8da9d722de30ee61ceb0d79b95e758c5fb3dddc811d33f0736ebc217df8edebc4904501ad70ada5c0ef860aae6fa65fb317273cbc8c0d7
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4wO5QPCBjPSNjPI/zjb0gX3ieE/6wJxBV56nBDZ0x:8uUIpT4vAj20O5sMSK/3bbXSeEd/md0x
- TLSH
  T175233A003BE9C12BF2BE5F7899F26145867AF6633603D54A1CC451DB4623FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2