asyncrat | b044a582b34962acb0f16fd01e32e0cc30b357438253e5f548e6ae8dbb724c09

Sharing

Copy URL Twitter E-mail

General

Target
b044a582b34962acb0f16fd01e32e0cc30b357438253e5f548e6ae8dbb724c09
Size 45KB
Sample260712-d9sgpacx2m
SHA256 b044a582b34962acb0f16fd01e32e0cc30b357438253e5f548e6ae8dbb724c09
MD5 d475f459ee1351e29646bfdfb1309656
SHA1 5d7e734a2381f3b0806e515c130931b3fe94cf7a
SHA512 87cbdcced8e9ab9ed456dbae16691cdaa64f8a9f6caf2b3bc2768e0c2c7bd1ad977dbeed31f6862392895a6349cff13b05c45275bcb81a7937c80d8b440c1e71
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9yiaLzwJAOPIcFzjbagXlif9HHd7DePyqMZmAp4BDZu:EulCJTHl42l5U23cF3bNX0FohQHp+dsx
TLSH
T1B7232B0037E8C22BF2BE4F7898F26145467AF6673603D68E1CC4519B5613FC6DA42AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexhay.com:80
mephimsexhay.com:22
mephimsexhay.com:8080
mephimsexhay.com:8880
mephimsexhay.com:2052
mephimsexhay.com:2082
mephimsexhay.com:2086
mephimsexhay.com:2095
mephimsexhay.com:443
mephimsexhay.com:2053
mephimsexhay.com:2083
mephimsexhay.com:2087
mephimsexhay.com:2096
mephimsexhay.com:8443
www.mephimsexhay.com:80
www.mephimsexhay.com:22
www.mephimsexhay.com:8080
www.mephimsexhay.com:8880
www.mephimsexhay.com:2052
www.mephimsexhay.com:2082
www.mephimsexhay.com:2086
www.mephimsexhay.com:2095
www.mephimsexhay.com:443
www.mephimsexhay.com:2053
www.mephimsexhay.com:2083
www.mephimsexhay.com:2087
www.mephimsexhay.com:2096
www.mephimsexhay.com:8443
hack.mephimsexhay.com:80
hack.mephimsexhay.com:22
hack.mephimsexhay.com:8080
hack.mephimsexhay.com:8880
hack.mephimsexhay.com:2052
hack.mephimsexhay.com:2082
hack.mephimsexhay.com:2086
hack.mephimsexhay.com:2095
hack.mephimsexhay.com:443
hack.mephimsexhay.com:2053
hack.mephimsexhay.com:2083
hack.mephimsexhay.com:2087
hack.mephimsexhay.com:2096
hack.mephimsexhay.com:8443
triton.mephimsexhay.com:80
triton.mephimsexhay.com:22
triton.mephimsexhay.com:8080
triton.mephimsexhay.com:8880
triton.mephimsexhay.com:2052
triton.mephimsexhay.com:2082
triton.mephimsexhay.com:2086
triton.mephimsexhay.com:2095
triton.mephimsexhay.com:443
triton.mephimsexhay.com:2053
triton.mephimsexhay.com:2083
triton.mephimsexhay.com:2087
triton.mephimsexhay.com:2096
triton.mephimsexhay.com:8443
formbook.mephimsexhay.com:80
formbook.mephimsexhay.com:22
formbook.mephimsexhay.com:8080
formbook.mephimsexhay.com:8880
formbook.mephimsexhay.com:2052
formbook.mephimsexhay.com:2082
formbook.mephimsexhay.com:2086
formbook.mephimsexhay.com:2095
formbook.mephimsexhay.com:443
formbook.mephimsexhay.com:2053
formbook.mephimsexhay.com:2083
formbook.mephimsexhay.com:2087
formbook.mephimsexhay.com:2096
formbook.mephimsexhay.com:8443

Mutex

GQ6FXJzjoIwY

Attributes

delay
0
install
true
install_file
vsiifo.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b044a582b34962acb0f16fd01e32e0cc30b357438253e5f548e6ae8dbb724c09
- Size 45KB
- SHA256 b044a582b34962acb0f16fd01e32e0cc30b357438253e5f548e6ae8dbb724c09
- MD5 d475f459ee1351e29646bfdfb1309656
- SHA1 5d7e734a2381f3b0806e515c130931b3fe94cf7a
- SHA512 87cbdcced8e9ab9ed456dbae16691cdaa64f8a9f6caf2b3bc2768e0c2c7bd1ad977dbeed31f6862392895a6349cff13b05c45275bcb81a7937c80d8b440c1e71
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9yiaLzwJAOPIcFzjbagXlif9HHd7DePyqMZmAp4BDZu:EulCJTHl42l5U23cF3bNX0FohQHp+dsx
- TLSH
  T1B7232B0037E8C22BF2BE4F7898F26145467AF6673603D68E1CC4519B5613FC6DA42AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2