asyncrat | 3d0963446dc78f6b84a56fe03decb77c44662f11bc597d93a5a1024d2ab9f253

Sharing

Copy URL Twitter E-mail

General

Target
3d0963446dc78f6b84a56fe03decb77c44662f11bc597d93a5a1024d2ab9f253
Size 45KB
Sample260712-d3rxkscw4p
SHA256 3d0963446dc78f6b84a56fe03decb77c44662f11bc597d93a5a1024d2ab9f253
MD5 c3e55bb5650567435662b3579a29cdc5
SHA1 293ead504671b95821c8f492fe506195c48a00fa
SHA512 6872b8ffb6126b91caaa77e2562ad9683a4a0099b1d14605faac85d031813a49db27bb013469d0a62a9a4f61736110f7b5e883ed3902c884cac136d3f07a5f99
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1yp7EcPIpzjbFgX3ikjIUcu6AVsBDZMx:kuSOpTPOP2W8V41Ehp3bCXSkjxvedMx
TLSH
T119232B003BE9813BF2BE4F7899F26145867AF6632603D58D1C8451DB5623FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexviet.com:80
mephimsexviet.com:22
mephimsexviet.com:8080
mephimsexviet.com:8880
mephimsexviet.com:2052
mephimsexviet.com:2082
mephimsexviet.com:2086
mephimsexviet.com:2095
mephimsexviet.com:443
mephimsexviet.com:2053
mephimsexviet.com:2083
mephimsexviet.com:2087
mephimsexviet.com:2096
mephimsexviet.com:8443
www.mephimsexviet.com:80
www.mephimsexviet.com:22
www.mephimsexviet.com:8080
www.mephimsexviet.com:8880
www.mephimsexviet.com:2052
www.mephimsexviet.com:2082
www.mephimsexviet.com:2086
www.mephimsexviet.com:2095
www.mephimsexviet.com:443
www.mephimsexviet.com:2053
www.mephimsexviet.com:2083
www.mephimsexviet.com:2087
www.mephimsexviet.com:2096
www.mephimsexviet.com:8443
malware.mephimsexviet.com:80
malware.mephimsexviet.com:22
malware.mephimsexviet.com:8080
malware.mephimsexviet.com:8880
malware.mephimsexviet.com:2052
malware.mephimsexviet.com:2082
malware.mephimsexviet.com:2086
malware.mephimsexviet.com:2095
malware.mephimsexviet.com:443
malware.mephimsexviet.com:2053
malware.mephimsexviet.com:2083
malware.mephimsexviet.com:2087
malware.mephimsexviet.com:2096
malware.mephimsexviet.com:8443
melissa.mephimsexviet.com:80
melissa.mephimsexviet.com:22
melissa.mephimsexviet.com:8080
melissa.mephimsexviet.com:8880
melissa.mephimsexviet.com:2052
melissa.mephimsexviet.com:2082
melissa.mephimsexviet.com:2086
melissa.mephimsexviet.com:2095
melissa.mephimsexviet.com:443
melissa.mephimsexviet.com:2053
melissa.mephimsexviet.com:2083
melissa.mephimsexviet.com:2087
melissa.mephimsexviet.com:2096
melissa.mephimsexviet.com:8443
iloveyou.mephimsexviet.com:80
iloveyou.mephimsexviet.com:22
iloveyou.mephimsexviet.com:8080
iloveyou.mephimsexviet.com:8880
iloveyou.mephimsexviet.com:2052
iloveyou.mephimsexviet.com:2082
iloveyou.mephimsexviet.com:2086
iloveyou.mephimsexviet.com:2095
iloveyou.mephimsexviet.com:443
iloveyou.mephimsexviet.com:2053
iloveyou.mephimsexviet.com:2083
iloveyou.mephimsexviet.com:2087
iloveyou.mephimsexviet.com:2096
iloveyou.mephimsexviet.com:8443

Mutex

xFCkqEIxeJer

Attributes

delay
0
install
true
install_file
pquw.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  3d0963446dc78f6b84a56fe03decb77c44662f11bc597d93a5a1024d2ab9f253
- Size 45KB
- SHA256 3d0963446dc78f6b84a56fe03decb77c44662f11bc597d93a5a1024d2ab9f253
- MD5 c3e55bb5650567435662b3579a29cdc5
- SHA1 293ead504671b95821c8f492fe506195c48a00fa
- SHA512 6872b8ffb6126b91caaa77e2562ad9683a4a0099b1d14605faac85d031813a49db27bb013469d0a62a9a4f61736110f7b5e883ed3902c884cac136d3f07a5f99
- SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1yp7EcPIpzjbFgX3ikjIUcu6AVsBDZMx:kuSOpTPOP2W8V41Ehp3bCXSkjxvedMx
- TLSH
  T119232B003BE9813BF2BE4F7899F26145867AF6632603D58D1C8451DB5623FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2