asyncrat | 47616c79695e3493b5068598eaacfb9a9312ea70263e50c765616c9b61c00534

Sharing

Copy URL Twitter E-mail

General

Target
47616c79695e3493b5068598eaacfb9a9312ea70263e50c765616c9b61c00534
Size 45KB
Sample260712-dxvraaew3w
SHA256 47616c79695e3493b5068598eaacfb9a9312ea70263e50c765616c9b61c00534
MD5 a75e1a72c17a6b1b022935f45945d229
SHA1 71b7f0bdce63812b928f37bab1bb10304577cd44
SHA512 622c6db2c0c1502c0ab2bc5ea26521aff5c9bf425d622d39a763fb98287a8fd883b5c1aac9572e7d72a7a72716023f931df97a3c376d73e46de21aa4140ed7c3
SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ0fBohEaEPIQgjbTgX3i/kfzSWRie1BDZUx:cuqb5TrhG2a4EapQIbMXSsSWhdUx
TLSH
T199231B003BE8822BF2BE4F785DF26145867AF6636603D54D1CC4129B5713FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexviet.com:80
mephimsexviet.com:22
mephimsexviet.com:8080
mephimsexviet.com:8880
mephimsexviet.com:2052
mephimsexviet.com:2082
mephimsexviet.com:2086
mephimsexviet.com:2095
mephimsexviet.com:443
mephimsexviet.com:2053
mephimsexviet.com:2083
mephimsexviet.com:2087
mephimsexviet.com:2096
mephimsexviet.com:8443
www.mephimsexviet.com:80
www.mephimsexviet.com:22
www.mephimsexviet.com:8080
www.mephimsexviet.com:8880
www.mephimsexviet.com:2052
www.mephimsexviet.com:2082
www.mephimsexviet.com:2086
www.mephimsexviet.com:2095
www.mephimsexviet.com:443
www.mephimsexviet.com:2053
www.mephimsexviet.com:2083
www.mephimsexviet.com:2087
www.mephimsexviet.com:2096
www.mephimsexviet.com:8443
sasser.mephimsexviet.com:80
sasser.mephimsexviet.com:22
sasser.mephimsexviet.com:8080
sasser.mephimsexviet.com:8880
sasser.mephimsexviet.com:2052
sasser.mephimsexviet.com:2082
sasser.mephimsexviet.com:2086
sasser.mephimsexviet.com:2095
sasser.mephimsexviet.com:443
sasser.mephimsexviet.com:2053
sasser.mephimsexviet.com:2083
sasser.mephimsexviet.com:2087
sasser.mephimsexviet.com:2096
sasser.mephimsexviet.com:8443
ryuk.mephimsexviet.com:80
ryuk.mephimsexviet.com:22
ryuk.mephimsexviet.com:8080
ryuk.mephimsexviet.com:8880
ryuk.mephimsexviet.com:2052
ryuk.mephimsexviet.com:2082
ryuk.mephimsexviet.com:2086
ryuk.mephimsexviet.com:2095
ryuk.mephimsexviet.com:443
ryuk.mephimsexviet.com:2053
ryuk.mephimsexviet.com:2083
ryuk.mephimsexviet.com:2087
ryuk.mephimsexviet.com:2096
ryuk.mephimsexviet.com:8443
invasive.mephimsexviet.com:80
invasive.mephimsexviet.com:22
invasive.mephimsexviet.com:8080
invasive.mephimsexviet.com:8880
invasive.mephimsexviet.com:2052
invasive.mephimsexviet.com:2082
invasive.mephimsexviet.com:2086
invasive.mephimsexviet.com:2095
invasive.mephimsexviet.com:443
invasive.mephimsexviet.com:2053
invasive.mephimsexviet.com:2083
invasive.mephimsexviet.com:2087
invasive.mephimsexviet.com:2096
invasive.mephimsexviet.com:8443
remcos.mephimsexviet.com:80
remcos.mephimsexviet.com:22
remcos.mephimsexviet.com:8080
remcos.mephimsexviet.com:8880
remcos.mephimsexviet.com:2052
remcos.mephimsexviet.com:2082
remcos.mephimsexviet.com:2086
remcos.mephimsexviet.com:2095
remcos.mephimsexviet.com:443
remcos.mephimsexviet.com:2053
remcos.mephimsexviet.com:2083
remcos.mephimsexviet.com:2087
remcos.mephimsexviet.com:2096
remcos.mephimsexviet.com:8443

Mutex

GNOEbCtSuzdE

Attributes

delay
0
install
true
install_file
xgdr8.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  47616c79695e3493b5068598eaacfb9a9312ea70263e50c765616c9b61c00534
- Size 45KB
- SHA256 47616c79695e3493b5068598eaacfb9a9312ea70263e50c765616c9b61c00534
- MD5 a75e1a72c17a6b1b022935f45945d229
- SHA1 71b7f0bdce63812b928f37bab1bb10304577cd44
- SHA512 622c6db2c0c1502c0ab2bc5ea26521aff5c9bf425d622d39a763fb98287a8fd883b5c1aac9572e7d72a7a72716023f931df97a3c376d73e46de21aa4140ed7c3
- SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ0fBohEaEPIQgjbTgX3i/kfzSWRie1BDZUx:cuqb5TrhG2a4EapQIbMXSsSWhdUx
- TLSH
  T199231B003BE8822BF2BE4F785DF26145867AF6636603D54D1CC4129B5713FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2