asyncrat | 04b6a8c33ebecd78353eed3d6139a34191fdc12391d826f66615b994feafab9b

Sharing

Copy URL Twitter E-mail

General

Target
04b6a8c33ebecd78353eed3d6139a34191fdc12391d826f66615b994feafab9b
Size 45KB
Sample260710-v5vvpaf19v
SHA256 04b6a8c33ebecd78353eed3d6139a34191fdc12391d826f66615b994feafab9b
MD5 babce8eab03bf8d89d8535fb865b9fd2
SHA1 d9e60ab616a5b4491172169308ce6b0409faebde
SHA512 72c225d3dd8c4c1a3676c38e3d7e0a85ebea7e48ca56a10706da072d4274b797ddeef31fe60f7994da4bf38cd9422ee94eb5cdc15639ca4e3a9690e8fcbaebfe
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAMHUttXAPIMzjbTgX3x5lcrV9FaogHsxRBDZcx:UuKWgSJTwRf280rXlM3bMXB5lcZ9FBNk
TLSH
T1F7232B003BE8C13BF2BE4FB8ADF26105467AF6736603D6491CC4519B5623FC69A426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsexz.org:80
phimsexz.org:22
phimsexz.org:8080
phimsexz.org:8880
phimsexz.org:2052
phimsexz.org:2082
phimsexz.org:2086
phimsexz.org:2095
phimsexz.org:443
phimsexz.org:2053
phimsexz.org:2083
phimsexz.org:2087
phimsexz.org:2096
phimsexz.org:8443
www.phimsexz.org:80
www.phimsexz.org:22
www.phimsexz.org:8080
www.phimsexz.org:8880
www.phimsexz.org:2052
www.phimsexz.org:2082
www.phimsexz.org:2086
www.phimsexz.org:2095
www.phimsexz.org:443
www.phimsexz.org:2053
www.phimsexz.org:2083
www.phimsexz.org:2087
www.phimsexz.org:2096
www.phimsexz.org:8443
zeus.phimsexz.org:80
zeus.phimsexz.org:22
zeus.phimsexz.org:8080
zeus.phimsexz.org:8880
zeus.phimsexz.org:2052
zeus.phimsexz.org:2082
zeus.phimsexz.org:2086
zeus.phimsexz.org:2095
zeus.phimsexz.org:443
zeus.phimsexz.org:2053
zeus.phimsexz.org:2083
zeus.phimsexz.org:2087
zeus.phimsexz.org:2096
zeus.phimsexz.org:8443
conficker.phimsexz.org:80
conficker.phimsexz.org:22
conficker.phimsexz.org:8080
conficker.phimsexz.org:8880
conficker.phimsexz.org:2052
conficker.phimsexz.org:2082
conficker.phimsexz.org:2086
conficker.phimsexz.org:2095
conficker.phimsexz.org:443
conficker.phimsexz.org:2053
conficker.phimsexz.org:2083
conficker.phimsexz.org:2087
conficker.phimsexz.org:2096
conficker.phimsexz.org:8443
notpetya.phimsexz.org:80
notpetya.phimsexz.org:22
notpetya.phimsexz.org:8080
notpetya.phimsexz.org:8880
notpetya.phimsexz.org:2052
notpetya.phimsexz.org:2082
notpetya.phimsexz.org:2086
notpetya.phimsexz.org:2095
notpetya.phimsexz.org:443
notpetya.phimsexz.org:2053
notpetya.phimsexz.org:2083
notpetya.phimsexz.org:2087
notpetya.phimsexz.org:2096
notpetya.phimsexz.org:8443
cryptolocker.phimsexz.org:80
cryptolocker.phimsexz.org:22
cryptolocker.phimsexz.org:8080
cryptolocker.phimsexz.org:8880
cryptolocker.phimsexz.org:2052
cryptolocker.phimsexz.org:2082
cryptolocker.phimsexz.org:2086
cryptolocker.phimsexz.org:2095
cryptolocker.phimsexz.org:443
cryptolocker.phimsexz.org:2053
cryptolocker.phimsexz.org:2083
cryptolocker.phimsexz.org:2087
cryptolocker.phimsexz.org:2096
cryptolocker.phimsexz.org:8443

Mutex

6htOSVVVqMDf

Attributes

delay
0
install
true
install_file
arxkwr7s.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  04b6a8c33ebecd78353eed3d6139a34191fdc12391d826f66615b994feafab9b
- Size 45KB
- SHA256 04b6a8c33ebecd78353eed3d6139a34191fdc12391d826f66615b994feafab9b
- MD5 babce8eab03bf8d89d8535fb865b9fd2
- SHA1 d9e60ab616a5b4491172169308ce6b0409faebde
- SHA512 72c225d3dd8c4c1a3676c38e3d7e0a85ebea7e48ca56a10706da072d4274b797ddeef31fe60f7994da4bf38cd9422ee94eb5cdc15639ca4e3a9690e8fcbaebfe
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAMHUttXAPIMzjbTgX3x5lcrV9FaogHsxRBDZcx:UuKWgSJTwRf280rXlM3bMXB5lcZ9FBNk
- TLSH
  T1F7232B003BE8C13BF2BE4FB8ADF26105467AF6736603D6491CC4519B5623FC69A426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2