asyncrat | b579e5000bb2c4de2d8a06e63c8f4496ea9272399eef48df88cd246cabb1ca7b

Sharing

Copy URL Twitter E-mail

General

Target
b579e5000bb2c4de2d8a06e63c8f4496ea9272399eef48df88cd246cabb1ca7b
Size 45KB
Sample260711-e84zrsdz5t
SHA256 b579e5000bb2c4de2d8a06e63c8f4496ea9272399eef48df88cd246cabb1ca7b
MD5 6f8c44c8682061ee90920ac7927491ea
SHA1 2ddad68a9a27b1dd8cc47393b540818c7f23ba8a
SHA512 8b3132918858ff54b196057e9a480d34028c564e97e6ee9b9f130840b580e2e92ed6fdd8509a2b5a0b99b615d02ba07fe23e3c82960ecccfa46427bf99f448ec
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEa+PIvOjbTgX3iUrtMuTrQmCXbly614DW9Eu:ku40ZTXEb2C4EaHvibMXSUBAmCLlHWD6
TLSH
T145231B003BE88227F2BE5F78ADF26145867EF6636603D5492CC401D75713BC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimxxxhd.com:80
phimxxxhd.com:22
phimxxxhd.com:8080
phimxxxhd.com:8880
phimxxxhd.com:2052
phimxxxhd.com:2082
phimxxxhd.com:2086
phimxxxhd.com:2095
phimxxxhd.com:443
phimxxxhd.com:2053
phimxxxhd.com:2083
phimxxxhd.com:2087
phimxxxhd.com:2096
phimxxxhd.com:8443
www.phimxxxhd.com:80
www.phimxxxhd.com:22
www.phimxxxhd.com:8080
www.phimxxxhd.com:8880
www.phimxxxhd.com:2052
www.phimxxxhd.com:2082
www.phimxxxhd.com:2086
www.phimxxxhd.com:2095
www.phimxxxhd.com:443
www.phimxxxhd.com:2053
www.phimxxxhd.com:2083
www.phimxxxhd.com:2087
www.phimxxxhd.com:2096
www.phimxxxhd.com:8443
hacker.phimxxxhd.com:80
hacker.phimxxxhd.com:22
hacker.phimxxxhd.com:8080
hacker.phimxxxhd.com:8880
hacker.phimxxxhd.com:2052
hacker.phimxxxhd.com:2082
hacker.phimxxxhd.com:2086
hacker.phimxxxhd.com:2095
hacker.phimxxxhd.com:443
hacker.phimxxxhd.com:2053
hacker.phimxxxhd.com:2083
hacker.phimxxxhd.com:2087
hacker.phimxxxhd.com:2096
hacker.phimxxxhd.com:8443
klez.phimxxxhd.com:80
klez.phimxxxhd.com:22
klez.phimxxxhd.com:8080
klez.phimxxxhd.com:8880
klez.phimxxxhd.com:2052
klez.phimxxxhd.com:2082
klez.phimxxxhd.com:2086
klez.phimxxxhd.com:2095
klez.phimxxxhd.com:443
klez.phimxxxhd.com:2053
klez.phimxxxhd.com:2083
klez.phimxxxhd.com:2087
klez.phimxxxhd.com:2096
klez.phimxxxhd.com:8443
downadup.phimxxxhd.com:80
downadup.phimxxxhd.com:22
downadup.phimxxxhd.com:8080
downadup.phimxxxhd.com:8880
downadup.phimxxxhd.com:2052
downadup.phimxxxhd.com:2082
downadup.phimxxxhd.com:2086
downadup.phimxxxhd.com:2095
downadup.phimxxxhd.com:443
downadup.phimxxxhd.com:2053
downadup.phimxxxhd.com:2083
downadup.phimxxxhd.com:2087
downadup.phimxxxhd.com:2096
downadup.phimxxxhd.com:8443
locky.phimxxxhd.com:80
locky.phimxxxhd.com:22
locky.phimxxxhd.com:8080
locky.phimxxxhd.com:8880
locky.phimxxxhd.com:2052
locky.phimxxxhd.com:2082
locky.phimxxxhd.com:2086
locky.phimxxxhd.com:2095
locky.phimxxxhd.com:443
locky.phimxxxhd.com:2053
locky.phimxxxhd.com:2083
locky.phimxxxhd.com:2087
locky.phimxxxhd.com:2096
locky.phimxxxhd.com:8443

Mutex

4TyXR7WQGH9Z

Attributes

delay
0
install
true
install_file
3lei6.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b579e5000bb2c4de2d8a06e63c8f4496ea9272399eef48df88cd246cabb1ca7b
- Size 45KB
- SHA256 b579e5000bb2c4de2d8a06e63c8f4496ea9272399eef48df88cd246cabb1ca7b
- MD5 6f8c44c8682061ee90920ac7927491ea
- SHA1 2ddad68a9a27b1dd8cc47393b540818c7f23ba8a
- SHA512 8b3132918858ff54b196057e9a480d34028c564e97e6ee9b9f130840b580e2e92ed6fdd8509a2b5a0b99b615d02ba07fe23e3c82960ecccfa46427bf99f448ec
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEa+PIvOjbTgX3iUrtMuTrQmCXbly614DW9Eu:ku40ZTXEb2C4EaHvibMXSUBAmCLlHWD6
- TLSH
  T145231B003BE88227F2BE5F78ADF26145867EF6636603D5492CC401D75713BC69A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2