asyncrat | cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f

Sharing

Copy URL Twitter E-mail

General

Target
cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f
Size 45KB
Sample260711-llb4sshv4w
SHA256 cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f
MD5 2d2bf0f2e97f9521ba6a392bae4c6209
SHA1 c7eb91e19272545d4da85686104f1a0a311d022c
SHA512 55277fc56049987cf85a5a34d1d84d930b6919212158911d35433c2595adefd32a4951d48694c52f120cd5790e30e97da88e4c8eaebfc6a5c4b8a2744f346daf
SSDEEP 768:HuCIJTQc5fVWUhxlDmo2qrm0UwPOlehAPITpzjb3gX3i7hE6m4jQ851BDZYx:HuCIJTQmX250/OghlTp3bQXS7+L3WdYx
TLSH
T110233A003BE8812BF2BE4F78A9F26145867AF6633603D6491CC451DB5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexviet.com:80
mephimsexviet.com:22
mephimsexviet.com:8080
mephimsexviet.com:8880
mephimsexviet.com:2052
mephimsexviet.com:2082
mephimsexviet.com:2086
mephimsexviet.com:2095
mephimsexviet.com:443
mephimsexviet.com:2053
mephimsexviet.com:2083
mephimsexviet.com:2087
mephimsexviet.com:2096
mephimsexviet.com:8443
www.mephimsexviet.com:80
www.mephimsexviet.com:22
www.mephimsexviet.com:8080
www.mephimsexviet.com:8880
www.mephimsexviet.com:2052
www.mephimsexviet.com:2082
www.mephimsexviet.com:2086
www.mephimsexviet.com:2095
www.mephimsexviet.com:443
www.mephimsexviet.com:2053
www.mephimsexviet.com:2083
www.mephimsexviet.com:2087
www.mephimsexviet.com:2096
www.mephimsexviet.com:8443
malware.mephimsexviet.com:80
malware.mephimsexviet.com:22
malware.mephimsexviet.com:8080
malware.mephimsexviet.com:8880
malware.mephimsexviet.com:2052
malware.mephimsexviet.com:2082
malware.mephimsexviet.com:2086
malware.mephimsexviet.com:2095
malware.mephimsexviet.com:443
malware.mephimsexviet.com:2053
malware.mephimsexviet.com:2083
malware.mephimsexviet.com:2087
malware.mephimsexviet.com:2096
malware.mephimsexviet.com:8443
codered.mephimsexviet.com:80
codered.mephimsexviet.com:22
codered.mephimsexviet.com:8080
codered.mephimsexviet.com:8880
codered.mephimsexviet.com:2052
codered.mephimsexviet.com:2082
codered.mephimsexviet.com:2086
codered.mephimsexviet.com:2095
codered.mephimsexviet.com:443
codered.mephimsexviet.com:2053
codered.mephimsexviet.com:2083
codered.mephimsexviet.com:2087
codered.mephimsexviet.com:2096
codered.mephimsexviet.com:8443
qakbot.mephimsexviet.com:80
qakbot.mephimsexviet.com:22
qakbot.mephimsexviet.com:8080
qakbot.mephimsexviet.com:8880
qakbot.mephimsexviet.com:2052
qakbot.mephimsexviet.com:2082
qakbot.mephimsexviet.com:2086
qakbot.mephimsexviet.com:2095
qakbot.mephimsexviet.com:443
qakbot.mephimsexviet.com:2053
qakbot.mephimsexviet.com:2083
qakbot.mephimsexviet.com:2087
qakbot.mephimsexviet.com:2096
qakbot.mephimsexviet.com:8443
blacklotus.mephimsexviet.com:80
blacklotus.mephimsexviet.com:22
blacklotus.mephimsexviet.com:8080
blacklotus.mephimsexviet.com:8880
blacklotus.mephimsexviet.com:2052
blacklotus.mephimsexviet.com:2082
blacklotus.mephimsexviet.com:2086
blacklotus.mephimsexviet.com:2095
blacklotus.mephimsexviet.com:443
blacklotus.mephimsexviet.com:2053
blacklotus.mephimsexviet.com:2083
blacklotus.mephimsexviet.com:2087
blacklotus.mephimsexviet.com:2096
blacklotus.mephimsexviet.com:8443

Mutex

RcQaXyEBE2Xo

Attributes

delay
0
install
true
install_file
kffe9mqv.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f
- Size 45KB
- SHA256 cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f
- MD5 2d2bf0f2e97f9521ba6a392bae4c6209
- SHA1 c7eb91e19272545d4da85686104f1a0a311d022c
- SHA512 55277fc56049987cf85a5a34d1d84d930b6919212158911d35433c2595adefd32a4951d48694c52f120cd5790e30e97da88e4c8eaebfc6a5c4b8a2744f346daf
- SSDEEP 768:HuCIJTQc5fVWUhxlDmo2qrm0UwPOlehAPITpzjb3gX3i7hE6m4jQ851BDZYx:HuCIJTQmX250/OghlTp3bQXS7+L3WdYx
- TLSH
  T110233A003BE8812BF2BE4F78A9F26145867AF6633603D6491CC451DB5723FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2