asyncrat | 7f4cf12affc522e4768801b63d02ba0a2162ca75e174d3af751430bc95fa0ff1

Sharing

Copy URL Twitter E-mail

General

Target
7f4cf12affc522e4768801b63d02ba0a2162ca75e174d3af751430bc95fa0ff1
Size 45KB
Sample260711-sg4ftadt7l
SHA256 7f4cf12affc522e4768801b63d02ba0a2162ca75e174d3af751430bc95fa0ff1
MD5 a519219a17899b91bb004f5b9be76220
SHA1 9228fc656f55be68615b90e1437b2283dc594c2a
SHA512 f29c081efa8972938b23f8bc5235f4a26a7d9b50fc95f39ec241bf254cd9d860188dcd5669ef6b9cf30c32b0120d47e99ea19acfe3418c388173a558916f6660
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwlm/9GgROPIpzjbegX3i5oJfjSKR11br/imBDZMx:ku40ZTXEb2xm1h3p3bhXS5oRFZbr/io8
TLSH
T1AE233B003BE8812BF2BE5F789DF26145857AF6636603D58A1CC441DB4B13FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexviet.com:80
mephimsexviet.com:22
mephimsexviet.com:8080
mephimsexviet.com:8880
mephimsexviet.com:2052
mephimsexviet.com:2082
mephimsexviet.com:2086
mephimsexviet.com:2095
mephimsexviet.com:443
mephimsexviet.com:2053
mephimsexviet.com:2083
mephimsexviet.com:2087
mephimsexviet.com:2096
mephimsexviet.com:8443
www.mephimsexviet.com:80
www.mephimsexviet.com:22
www.mephimsexviet.com:8080
www.mephimsexviet.com:8880
www.mephimsexviet.com:2052
www.mephimsexviet.com:2082
www.mephimsexviet.com:2086
www.mephimsexviet.com:2095
www.mephimsexviet.com:443
www.mephimsexviet.com:2053
www.mephimsexviet.com:2083
www.mephimsexviet.com:2087
www.mephimsexviet.com:2096
www.mephimsexviet.com:8443
triton.mephimsexviet.com:80
triton.mephimsexviet.com:22
triton.mephimsexviet.com:8080
triton.mephimsexviet.com:8880
triton.mephimsexviet.com:2052
triton.mephimsexviet.com:2082
triton.mephimsexviet.com:2086
triton.mephimsexviet.com:2095
triton.mephimsexviet.com:443
triton.mephimsexviet.com:2053
triton.mephimsexviet.com:2083
triton.mephimsexviet.com:2087
triton.mephimsexviet.com:2096
triton.mephimsexviet.com:8443
gootloader.mephimsexviet.com:80
gootloader.mephimsexviet.com:22
gootloader.mephimsexviet.com:8080
gootloader.mephimsexviet.com:8880
gootloader.mephimsexviet.com:2052
gootloader.mephimsexviet.com:2082
gootloader.mephimsexviet.com:2086
gootloader.mephimsexviet.com:2095
gootloader.mephimsexviet.com:443
gootloader.mephimsexviet.com:2053
gootloader.mephimsexviet.com:2083
gootloader.mephimsexviet.com:2087
gootloader.mephimsexviet.com:2096
gootloader.mephimsexviet.com:8443
revil.mephimsexviet.com:80
revil.mephimsexviet.com:22
revil.mephimsexviet.com:8080
revil.mephimsexviet.com:8880
revil.mephimsexviet.com:2052
revil.mephimsexviet.com:2082
revil.mephimsexviet.com:2086
revil.mephimsexviet.com:2095
revil.mephimsexviet.com:443
revil.mephimsexviet.com:2053
revil.mephimsexviet.com:2083
revil.mephimsexviet.com:2087
revil.mephimsexviet.com:2096
revil.mephimsexviet.com:8443

Mutex

z2Ys4gZt2vai

Attributes

delay
0
install
true
install_file
073fg.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  7f4cf12affc522e4768801b63d02ba0a2162ca75e174d3af751430bc95fa0ff1
- Size 45KB
- SHA256 7f4cf12affc522e4768801b63d02ba0a2162ca75e174d3af751430bc95fa0ff1
- MD5 a519219a17899b91bb004f5b9be76220
- SHA1 9228fc656f55be68615b90e1437b2283dc594c2a
- SHA512 f29c081efa8972938b23f8bc5235f4a26a7d9b50fc95f39ec241bf254cd9d860188dcd5669ef6b9cf30c32b0120d47e99ea19acfe3418c388173a558916f6660
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwlm/9GgROPIpzjbegX3i5oJfjSKR11br/imBDZMx:ku40ZTXEb2xm1h3p3bhXS5oRFZbr/io8
- TLSH
  T1AE233B003BE8812BF2BE5F789DF26145857AF6636603D58A1CC441DB4B13FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2