asyncrat | 54e5b5a63c62ce68c8969d99badceb979b5d9a59662444b50045ce27f2b9cc29

Sharing

Copy URL Twitter E-mail

General

Target
54e5b5a63c62ce68c8969d99badceb979b5d9a59662444b50045ce27f2b9cc29
Size 45KB
Sample260711-tfbvvaev9m
SHA256 54e5b5a63c62ce68c8969d99badceb979b5d9a59662444b50045ce27f2b9cc29
MD5 abf2dc59208e3d2a8be13cd5c70e86f2
SHA1 b368e32be07891a95b76e6d4d44598abc94b5e6f
SHA512 fcca8d8f23f32fb2c49479ec9dc7cd160e55cefa2152ccfdda0d073026c6bd7fb34b265bc590c57c9223e93e63408a001d620e8e638af576dcca5783f41b6655
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UwD/y/aqPIKzjbpgX3iaJd3tCr6BDZ0x:8uUIpT4vAj2wkhK3bmXSaJlArkd0x
TLSH
T10A232B0037E9C12BF2BE4B789DF26245867AF6633603D58D1CC452DB1613BC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexhay.com:80
mephimsexhay.com:22
mephimsexhay.com:8080
mephimsexhay.com:8880
mephimsexhay.com:2052
mephimsexhay.com:2082
mephimsexhay.com:2086
mephimsexhay.com:2095
mephimsexhay.com:443
mephimsexhay.com:2053
mephimsexhay.com:2083
mephimsexhay.com:2087
mephimsexhay.com:2096
mephimsexhay.com:8443
www.mephimsexhay.com:80
www.mephimsexhay.com:22
www.mephimsexhay.com:8080
www.mephimsexhay.com:8880
www.mephimsexhay.com:2052
www.mephimsexhay.com:2082
www.mephimsexhay.com:2086
www.mephimsexhay.com:2095
www.mephimsexhay.com:443
www.mephimsexhay.com:2053
www.mephimsexhay.com:2083
www.mephimsexhay.com:2087
www.mephimsexhay.com:2096
www.mephimsexhay.com:8443
blacklotus.mephimsexhay.com:80
blacklotus.mephimsexhay.com:22
blacklotus.mephimsexhay.com:8080
blacklotus.mephimsexhay.com:8880
blacklotus.mephimsexhay.com:2052
blacklotus.mephimsexhay.com:2082
blacklotus.mephimsexhay.com:2086
blacklotus.mephimsexhay.com:2095
blacklotus.mephimsexhay.com:443
blacklotus.mephimsexhay.com:2053
blacklotus.mephimsexhay.com:2083
blacklotus.mephimsexhay.com:2087
blacklotus.mephimsexhay.com:2096
blacklotus.mephimsexhay.com:8443
trisis.mephimsexhay.com:80
trisis.mephimsexhay.com:22
trisis.mephimsexhay.com:8080
trisis.mephimsexhay.com:8880
trisis.mephimsexhay.com:2052
trisis.mephimsexhay.com:2082
trisis.mephimsexhay.com:2086
trisis.mephimsexhay.com:2095
trisis.mephimsexhay.com:443
trisis.mephimsexhay.com:2053
trisis.mephimsexhay.com:2083
trisis.mephimsexhay.com:2087
trisis.mephimsexhay.com:2096
trisis.mephimsexhay.com:8443
remcos.mephimsexhay.com:80
remcos.mephimsexhay.com:22
remcos.mephimsexhay.com:8080
remcos.mephimsexhay.com:8880
remcos.mephimsexhay.com:2052
remcos.mephimsexhay.com:2082
remcos.mephimsexhay.com:2086
remcos.mephimsexhay.com:2095
remcos.mephimsexhay.com:443
remcos.mephimsexhay.com:2053
remcos.mephimsexhay.com:2083
remcos.mephimsexhay.com:2087
remcos.mephimsexhay.com:2096
remcos.mephimsexhay.com:8443

Mutex

KuHU1dDFUlyD

Attributes

delay
0
install
true
install_file
kie9335.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  54e5b5a63c62ce68c8969d99badceb979b5d9a59662444b50045ce27f2b9cc29
- Size 45KB
- SHA256 54e5b5a63c62ce68c8969d99badceb979b5d9a59662444b50045ce27f2b9cc29
- MD5 abf2dc59208e3d2a8be13cd5c70e86f2
- SHA1 b368e32be07891a95b76e6d4d44598abc94b5e6f
- SHA512 fcca8d8f23f32fb2c49479ec9dc7cd160e55cefa2152ccfdda0d073026c6bd7fb34b265bc590c57c9223e93e63408a001d620e8e638af576dcca5783f41b6655
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UwD/y/aqPIKzjbpgX3iaJd3tCr6BDZ0x:8uUIpT4vAj2wkhK3bmXSaJlArkd0x
- TLSH
  T10A232B0037E9C12BF2BE4B789DF26245867AF6633603D58D1CC452DB1613BC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2