asyncrat | b5385a8b67ce4105404a2c34d2de09c17ce7d75ee7aed13a08966bf3f6910904

Sharing

Copy URL Twitter E-mail

General

Target
b5385a8b67ce4105404a2c34d2de09c17ce7d75ee7aed13a08966bf3f6910904
Size 45KB
Sample260711-p7rcdscy2t
SHA256 b5385a8b67ce4105404a2c34d2de09c17ce7d75ee7aed13a08966bf3f6910904
MD5 2e018c41f610250ef156dd781973ff51
SHA1 a7808145acf5f85299d24dd9f6bc9d3dea358eb1
SHA512 b0d5774627c419c392b7be2d6af373a666b1fa35b96e3e30752fb1c664cb949a8b959bccc70561be4c43066ebdc14166372ea81f6d224dcd0cc4855839ce75d5
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVE/q0CCMOd4Cpb8PIDvjb8gX3imM3EkDe20p5QBDZG:MuBGJTPho2d4CtVBDbbTXSmM3EkDF0GE
TLSH
T116232A003BE9812BF2BE4B7899F26245867BF5733603D54A1CC451DB5723FC68A43AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexviet.com:80
mephimsexviet.com:22
mephimsexviet.com:8080
mephimsexviet.com:8880
mephimsexviet.com:2052
mephimsexviet.com:2082
mephimsexviet.com:2086
mephimsexviet.com:2095
mephimsexviet.com:443
mephimsexviet.com:2053
mephimsexviet.com:2083
mephimsexviet.com:2087
mephimsexviet.com:2096
mephimsexviet.com:8443
www.mephimsexviet.com:80
www.mephimsexviet.com:22
www.mephimsexviet.com:8080
www.mephimsexviet.com:8880
www.mephimsexviet.com:2052
www.mephimsexviet.com:2082
www.mephimsexviet.com:2086
www.mephimsexviet.com:2095
www.mephimsexviet.com:443
www.mephimsexviet.com:2053
www.mephimsexviet.com:2083
www.mephimsexviet.com:2087
www.mephimsexviet.com:2096
www.mephimsexviet.com:8443
cl0p.mephimsexviet.com:80
cl0p.mephimsexviet.com:22
cl0p.mephimsexviet.com:8080
cl0p.mephimsexviet.com:8880
cl0p.mephimsexviet.com:2052
cl0p.mephimsexviet.com:2082
cl0p.mephimsexviet.com:2086
cl0p.mephimsexviet.com:2095
cl0p.mephimsexviet.com:443
cl0p.mephimsexviet.com:2053
cl0p.mephimsexviet.com:2083
cl0p.mephimsexviet.com:2087
cl0p.mephimsexviet.com:2096
cl0p.mephimsexviet.com:8443
blaster.mephimsexviet.com:80
blaster.mephimsexviet.com:22
blaster.mephimsexviet.com:8080
blaster.mephimsexviet.com:8880
blaster.mephimsexviet.com:2052
blaster.mephimsexviet.com:2082
blaster.mephimsexviet.com:2086
blaster.mephimsexviet.com:2095
blaster.mephimsexviet.com:443
blaster.mephimsexviet.com:2053
blaster.mephimsexviet.com:2083
blaster.mephimsexviet.com:2087
blaster.mephimsexviet.com:2096
blaster.mephimsexviet.com:8443
zeus.mephimsexviet.com:80
zeus.mephimsexviet.com:22
zeus.mephimsexviet.com:8080
zeus.mephimsexviet.com:8880
zeus.mephimsexviet.com:2052
zeus.mephimsexviet.com:2082
zeus.mephimsexviet.com:2086
zeus.mephimsexviet.com:2095
zeus.mephimsexviet.com:443
zeus.mephimsexviet.com:2053
zeus.mephimsexviet.com:2083
zeus.mephimsexviet.com:2087
zeus.mephimsexviet.com:2096
zeus.mephimsexviet.com:8443

Mutex

RrBLw5Bg0FDH

Attributes

delay
0
install
true
install_file
m3dd.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b5385a8b67ce4105404a2c34d2de09c17ce7d75ee7aed13a08966bf3f6910904
- Size 45KB
- SHA256 b5385a8b67ce4105404a2c34d2de09c17ce7d75ee7aed13a08966bf3f6910904
- MD5 2e018c41f610250ef156dd781973ff51
- SHA1 a7808145acf5f85299d24dd9f6bc9d3dea358eb1
- SHA512 b0d5774627c419c392b7be2d6af373a666b1fa35b96e3e30752fb1c664cb949a8b959bccc70561be4c43066ebdc14166372ea81f6d224dcd0cc4855839ce75d5
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVE/q0CCMOd4Cpb8PIDvjb8gX3imM3EkDe20p5QBDZG:MuBGJTPho2d4CtVBDbbTXSmM3EkDF0GE
- TLSH
  T116232A003BE9812BF2BE4B7899F26245867BF5733603D54A1CC451DB5723FC68A43AE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2