asyncrat | 18f5f16708bd552dc4c500d79af95a1b9e1e7acc44930b9fcb4495eb7ba1eb58

Sharing

Copy URL Twitter E-mail

General

Target
18f5f16708bd552dc4c500d79af95a1b9e1e7acc44930b9fcb4495eb7ba1eb58
Size 45KB
Sample260711-xnavashw6m
SHA256 18f5f16708bd552dc4c500d79af95a1b9e1e7acc44930b9fcb4495eb7ba1eb58
MD5 adc899d4bbd78582f97fb19d7b937e70
SHA1 d95505b145e43a75bfbfbf220967ccd0dfdd88c3
SHA512 5fafd1eb70502b80ff6f10afda09042041e5408d76b87cf476db0495375fc4fa47fe59e5296bff1b8b24234c027f9f61fea2aec89c42b739a6249520a7247966
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAmFaPklZL3APIFzjbqgX3iLq7zCaMBmEdBBDZcx:UuKWgSJTwRf22EkfL3lF3b9XSLqyaImn
TLSH
T1AB2319003BE9813BF2BE4F7899F26145867AF2636603D64A1CC441DB5623FC6DA426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexhay.com:80
mephimsexhay.com:22
mephimsexhay.com:8080
mephimsexhay.com:8880
mephimsexhay.com:2052
mephimsexhay.com:2082
mephimsexhay.com:2086
mephimsexhay.com:2095
mephimsexhay.com:443
mephimsexhay.com:2053
mephimsexhay.com:2083
mephimsexhay.com:2087
mephimsexhay.com:2096
mephimsexhay.com:8443
www.mephimsexhay.com:80
www.mephimsexhay.com:22
www.mephimsexhay.com:8080
www.mephimsexhay.com:8880
www.mephimsexhay.com:2052
www.mephimsexhay.com:2082
www.mephimsexhay.com:2086
www.mephimsexhay.com:2095
www.mephimsexhay.com:443
www.mephimsexhay.com:2053
www.mephimsexhay.com:2083
www.mephimsexhay.com:2087
www.mephimsexhay.com:2096
www.mephimsexhay.com:8443
nimda.mephimsexhay.com:80
nimda.mephimsexhay.com:22
nimda.mephimsexhay.com:8080
nimda.mephimsexhay.com:8880
nimda.mephimsexhay.com:2052
nimda.mephimsexhay.com:2082
nimda.mephimsexhay.com:2086
nimda.mephimsexhay.com:2095
nimda.mephimsexhay.com:443
nimda.mephimsexhay.com:2053
nimda.mephimsexhay.com:2083
nimda.mephimsexhay.com:2087
nimda.mephimsexhay.com:2096
nimda.mephimsexhay.com:8443
cryptolocker.mephimsexhay.com:80
cryptolocker.mephimsexhay.com:22
cryptolocker.mephimsexhay.com:8080
cryptolocker.mephimsexhay.com:8880
cryptolocker.mephimsexhay.com:2052
cryptolocker.mephimsexhay.com:2082
cryptolocker.mephimsexhay.com:2086
cryptolocker.mephimsexhay.com:2095
cryptolocker.mephimsexhay.com:443
cryptolocker.mephimsexhay.com:2053
cryptolocker.mephimsexhay.com:2083
cryptolocker.mephimsexhay.com:2087
cryptolocker.mephimsexhay.com:2096
cryptolocker.mephimsexhay.com:8443
blaster.mephimsexhay.com:80
blaster.mephimsexhay.com:22
blaster.mephimsexhay.com:8080
blaster.mephimsexhay.com:8880
blaster.mephimsexhay.com:2052
blaster.mephimsexhay.com:2082
blaster.mephimsexhay.com:2086
blaster.mephimsexhay.com:2095
blaster.mephimsexhay.com:443
blaster.mephimsexhay.com:2053
blaster.mephimsexhay.com:2083
blaster.mephimsexhay.com:2087
blaster.mephimsexhay.com:2096
blaster.mephimsexhay.com:8443

Mutex

MjonFMQuu6HN

Attributes

delay
0
install
true
install_file
eem5g2ly.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  18f5f16708bd552dc4c500d79af95a1b9e1e7acc44930b9fcb4495eb7ba1eb58
- Size 45KB
- SHA256 18f5f16708bd552dc4c500d79af95a1b9e1e7acc44930b9fcb4495eb7ba1eb58
- MD5 adc899d4bbd78582f97fb19d7b937e70
- SHA1 d95505b145e43a75bfbfbf220967ccd0dfdd88c3
- SHA512 5fafd1eb70502b80ff6f10afda09042041e5408d76b87cf476db0495375fc4fa47fe59e5296bff1b8b24234c027f9f61fea2aec89c42b739a6249520a7247966
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAmFaPklZL3APIFzjbqgX3iLq7zCaMBmEdBBDZcx:UuKWgSJTwRf22EkfL3lF3b9XSLqyaImn
- TLSH
  T1AB2319003BE9813BF2BE4F7899F26145867AF2636603D64A1CC441DB5623FC6DA426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2