asyncrat | a0cc9b61dc6e18cc213e8c5b26f3812081de71e02f6b3d4de8d8aa51e74fc99d

Sharing

Copy URL Twitter E-mail

General

Target
a0cc9b61dc6e18cc213e8c5b26f3812081de71e02f6b3d4de8d8aa51e74fc99d.exe
Size 45KB
Sample260712-dnnllsev7t
SHA256 a0cc9b61dc6e18cc213e8c5b26f3812081de71e02f6b3d4de8d8aa51e74fc99d
MD5 bb5800b17bab4f797bd14f94477c9b5d
SHA1 c6426d3cc14836784f66e26b0c6adb7c6eb34500
SHA512 c60ae70f9963d6f7b89d4951f57907f23d50a6368274b6ce4e7076e0e16e122225b888aab5dce822757cb26d22bda431e4aa7fdf50c2dd6b3b891915844ce017
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYJG1HJhOPIcczjbMgr3iPQEzMydGzlBDZ0x:8uuSpTgyf2UFj3cc3bDrSPp9dG/d0x
TLSH
T15B231A0037E8812BF2BE4F74ACF26145867AF6673603E58E1CC4519B5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexviet.com:80
mephimsexviet.com:22
mephimsexviet.com:8080
mephimsexviet.com:8880
mephimsexviet.com:2052
mephimsexviet.com:2082
mephimsexviet.com:2086
mephimsexviet.com:2095
mephimsexviet.com:443
mephimsexviet.com:2053
mephimsexviet.com:2083
mephimsexviet.com:2087
mephimsexviet.com:2096
mephimsexviet.com:8443
www.mephimsexviet.com:80
www.mephimsexviet.com:22
www.mephimsexviet.com:8080
www.mephimsexviet.com:8880
www.mephimsexviet.com:2052
www.mephimsexviet.com:2082
www.mephimsexviet.com:2086
www.mephimsexviet.com:2095
www.mephimsexviet.com:443
www.mephimsexviet.com:2053
www.mephimsexviet.com:2083
www.mephimsexviet.com:2087
www.mephimsexviet.com:2096
www.mephimsexviet.com:8443
emotet.mephimsexviet.com:80
emotet.mephimsexviet.com:22
emotet.mephimsexviet.com:8080
emotet.mephimsexviet.com:8880
emotet.mephimsexviet.com:2052
emotet.mephimsexviet.com:2082
emotet.mephimsexviet.com:2086
emotet.mephimsexviet.com:2095
emotet.mephimsexviet.com:443
emotet.mephimsexviet.com:2053
emotet.mephimsexviet.com:2083
emotet.mephimsexviet.com:2087
emotet.mephimsexviet.com:2096
emotet.mephimsexviet.com:8443
agenttesla.mephimsexviet.com:80
agenttesla.mephimsexviet.com:22
agenttesla.mephimsexviet.com:8080
agenttesla.mephimsexviet.com:8880
agenttesla.mephimsexviet.com:2052
agenttesla.mephimsexviet.com:2082
agenttesla.mephimsexviet.com:2086
agenttesla.mephimsexviet.com:2095
agenttesla.mephimsexviet.com:443
agenttesla.mephimsexviet.com:2053
agenttesla.mephimsexviet.com:2083
agenttesla.mephimsexviet.com:2087
agenttesla.mephimsexviet.com:2096
agenttesla.mephimsexviet.com:8443
stuxnet.mephimsexviet.com:80
stuxnet.mephimsexviet.com:22
stuxnet.mephimsexviet.com:8080
stuxnet.mephimsexviet.com:8880
stuxnet.mephimsexviet.com:2052
stuxnet.mephimsexviet.com:2082
stuxnet.mephimsexviet.com:2086
stuxnet.mephimsexviet.com:2095
stuxnet.mephimsexviet.com:443
stuxnet.mephimsexviet.com:2053
stuxnet.mephimsexviet.com:2083
stuxnet.mephimsexviet.com:2087
stuxnet.mephimsexviet.com:2096
stuxnet.mephimsexviet.com:8443

Mutex

wpARoZ8c2b5C

Attributes

delay
0
install
true
install_file
fs4aom.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a0cc9b61dc6e18cc213e8c5b26f3812081de71e02f6b3d4de8d8aa51e74fc99d.exe
- Size 45KB
- SHA256 a0cc9b61dc6e18cc213e8c5b26f3812081de71e02f6b3d4de8d8aa51e74fc99d
- MD5 bb5800b17bab4f797bd14f94477c9b5d
- SHA1 c6426d3cc14836784f66e26b0c6adb7c6eb34500
- SHA512 c60ae70f9963d6f7b89d4951f57907f23d50a6368274b6ce4e7076e0e16e122225b888aab5dce822757cb26d22bda431e4aa7fdf50c2dd6b3b891915844ce017
- SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYJG1HJhOPIcczjbMgr3iPQEzMydGzlBDZ0x:8uuSpTgyf2UFj3cc3bDrSPp9dG/d0x
- TLSH
  T15B231A0037E8812BF2BE4F74ACF26145867AF6673603E58E1CC4519B5613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2