asyncrat | 52af1c63dd4e9406cf3cc3ca76f41197bb9d20885b35bf830505147ac0c8efac

Sharing

Copy URL Twitter E-mail

General

Target
52af1c63dd4e9406cf3cc3ca76f41197bb9d20885b35bf830505147ac0c8efac
Size 45KB
Sample260711-ws4shagv2j
SHA256 52af1c63dd4e9406cf3cc3ca76f41197bb9d20885b35bf830505147ac0c8efac
MD5 dee0f5dcbe7aebe3dfa5776176cd7c37
SHA1 773e1116cf9c9235c6a134c5ec1769de3081629c
SHA512 7b8cac6845e48ce6cf067d15a34bf49215ff508fbc8fdf20b7a06cc8e430e75316049cd5149c03d6f78a254ea64017172c8e223b8b5c7bc41724d375d2a7fd64
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qACLiE0yFjrdjYkk8PIuSjbtgX3iHkGxhtTVEm5BDg:cuqNJTLr62yLBXQBu+b6XSHkQTVxndUx
TLSH
T152232B0037E98127F6BE4F74A9F26205867AF6632603D54E1C8451DB5723FC68A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexhay.com:80
mephimsexhay.com:22
mephimsexhay.com:8080
mephimsexhay.com:8880
mephimsexhay.com:2052
mephimsexhay.com:2082
mephimsexhay.com:2086
mephimsexhay.com:2095
mephimsexhay.com:443
mephimsexhay.com:2053
mephimsexhay.com:2083
mephimsexhay.com:2087
mephimsexhay.com:2096
mephimsexhay.com:8443
www.mephimsexhay.com:80
www.mephimsexhay.com:22
www.mephimsexhay.com:8080
www.mephimsexhay.com:8880
www.mephimsexhay.com:2052
www.mephimsexhay.com:2082
www.mephimsexhay.com:2086
www.mephimsexhay.com:2095
www.mephimsexhay.com:443
www.mephimsexhay.com:2053
www.mephimsexhay.com:2083
www.mephimsexhay.com:2087
www.mephimsexhay.com:2096
www.mephimsexhay.com:8443
trisis.mephimsexhay.com:80
trisis.mephimsexhay.com:22
trisis.mephimsexhay.com:8080
trisis.mephimsexhay.com:8880
trisis.mephimsexhay.com:2052
trisis.mephimsexhay.com:2082
trisis.mephimsexhay.com:2086
trisis.mephimsexhay.com:2095
trisis.mephimsexhay.com:443
trisis.mephimsexhay.com:2053
trisis.mephimsexhay.com:2083
trisis.mephimsexhay.com:2087
trisis.mephimsexhay.com:2096
trisis.mephimsexhay.com:8443
gootloader.mephimsexhay.com:80
gootloader.mephimsexhay.com:22
gootloader.mephimsexhay.com:8080
gootloader.mephimsexhay.com:8880
gootloader.mephimsexhay.com:2052
gootloader.mephimsexhay.com:2082
gootloader.mephimsexhay.com:2086
gootloader.mephimsexhay.com:2095
gootloader.mephimsexhay.com:443
gootloader.mephimsexhay.com:2053
gootloader.mephimsexhay.com:2083
gootloader.mephimsexhay.com:2087
gootloader.mephimsexhay.com:2096
gootloader.mephimsexhay.com:8443
ursnif.mephimsexhay.com:80
ursnif.mephimsexhay.com:22
ursnif.mephimsexhay.com:8080
ursnif.mephimsexhay.com:8880
ursnif.mephimsexhay.com:2052
ursnif.mephimsexhay.com:2082
ursnif.mephimsexhay.com:2086
ursnif.mephimsexhay.com:2095
ursnif.mephimsexhay.com:443
ursnif.mephimsexhay.com:2053
ursnif.mephimsexhay.com:2083
ursnif.mephimsexhay.com:2087
ursnif.mephimsexhay.com:2096
ursnif.mephimsexhay.com:8443
mirai.mephimsexhay.com:80
mirai.mephimsexhay.com:22
mirai.mephimsexhay.com:8080
mirai.mephimsexhay.com:8880
mirai.mephimsexhay.com:2052
mirai.mephimsexhay.com:2082
mirai.mephimsexhay.com:2086
mirai.mephimsexhay.com:2095
mirai.mephimsexhay.com:443
mirai.mephimsexhay.com:2053
mirai.mephimsexhay.com:2083
mirai.mephimsexhay.com:2087
mirai.mephimsexhay.com:2096
mirai.mephimsexhay.com:8443

Mutex

qHQx56GQfS66

Attributes

delay
0
install
true
install_file
kc58.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  52af1c63dd4e9406cf3cc3ca76f41197bb9d20885b35bf830505147ac0c8efac
- Size 45KB
- SHA256 52af1c63dd4e9406cf3cc3ca76f41197bb9d20885b35bf830505147ac0c8efac
- MD5 dee0f5dcbe7aebe3dfa5776176cd7c37
- SHA1 773e1116cf9c9235c6a134c5ec1769de3081629c
- SHA512 7b8cac6845e48ce6cf067d15a34bf49215ff508fbc8fdf20b7a06cc8e430e75316049cd5149c03d6f78a254ea64017172c8e223b8b5c7bc41724d375d2a7fd64
- SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qACLiE0yFjrdjYkk8PIuSjbtgX3iHkGxhtTVEm5BDg:cuqNJTLr62yLBXQBu+b6XSHkQTVxndUx
- TLSH
  T152232B0037E98127F6BE4F74A9F26205867AF6632603D54E1C8451DB5723FC68A43AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2