asyncrat | 8e52485688de33fcbda3c59cd5c56edd0ca69525692fccfc9a1dd638ca58d5ed

Sharing

Copy URL Twitter E-mail

General

Target
8e52485688de33fcbda3c59cd5c56edd0ca69525692fccfc9a1dd638ca58d5ed
Size 45KB
Sample260712-dyplnaew3z
SHA256 8e52485688de33fcbda3c59cd5c56edd0ca69525692fccfc9a1dd638ca58d5ed
MD5 81a43371aa1bae9fd3049d2191335ab5
SHA1 084ffdb2fb1680370c7f2668b5eb4fbc087b2a3c
SHA512 490160aa1096e34e14f5656f9d491a5dd0cc9538f912aa8ffe0d09c77a623939be69319905e6d25edbfe282dbdbeb4856c478d1ae6e1cde5486860881ad70f9b
SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMITnyXaaPIYzjbWgX3ikvt7SavgfsBDZ8x:0u2vpTDe+2FEZY3bJXSEvYCd8x
TLSH
T1BA231A003BE9812BF2BF5F7899F26145867AF6632603D58D1CC011DB5713BC68A52AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexhay.com:80
mephimsexhay.com:22
mephimsexhay.com:8080
mephimsexhay.com:8880
mephimsexhay.com:2052
mephimsexhay.com:2082
mephimsexhay.com:2086
mephimsexhay.com:2095
mephimsexhay.com:443
mephimsexhay.com:2053
mephimsexhay.com:2083
mephimsexhay.com:2087
mephimsexhay.com:2096
mephimsexhay.com:8443
www.mephimsexhay.com:80
www.mephimsexhay.com:22
www.mephimsexhay.com:8080
www.mephimsexhay.com:8880
www.mephimsexhay.com:2052
www.mephimsexhay.com:2082
www.mephimsexhay.com:2086
www.mephimsexhay.com:2095
www.mephimsexhay.com:443
www.mephimsexhay.com:2053
www.mephimsexhay.com:2083
www.mephimsexhay.com:2087
www.mephimsexhay.com:2096
www.mephimsexhay.com:8443
wannacry.mephimsexhay.com:80
wannacry.mephimsexhay.com:22
wannacry.mephimsexhay.com:8080
wannacry.mephimsexhay.com:8880
wannacry.mephimsexhay.com:2052
wannacry.mephimsexhay.com:2082
wannacry.mephimsexhay.com:2086
wannacry.mephimsexhay.com:2095
wannacry.mephimsexhay.com:443
wannacry.mephimsexhay.com:2053
wannacry.mephimsexhay.com:2083
wannacry.mephimsexhay.com:2087
wannacry.mephimsexhay.com:2096
wannacry.mephimsexhay.com:8443
blaster.mephimsexhay.com:80
blaster.mephimsexhay.com:22
blaster.mephimsexhay.com:8080
blaster.mephimsexhay.com:8880
blaster.mephimsexhay.com:2052
blaster.mephimsexhay.com:2082
blaster.mephimsexhay.com:2086
blaster.mephimsexhay.com:2095
blaster.mephimsexhay.com:443
blaster.mephimsexhay.com:2053
blaster.mephimsexhay.com:2083
blaster.mephimsexhay.com:2087
blaster.mephimsexhay.com:2096
blaster.mephimsexhay.com:8443
revil.mephimsexhay.com:80
revil.mephimsexhay.com:22
revil.mephimsexhay.com:8080
revil.mephimsexhay.com:8880
revil.mephimsexhay.com:2052
revil.mephimsexhay.com:2082
revil.mephimsexhay.com:2086
revil.mephimsexhay.com:2095
revil.mephimsexhay.com:443
revil.mephimsexhay.com:2053
revil.mephimsexhay.com:2083
revil.mephimsexhay.com:2087
revil.mephimsexhay.com:2096
revil.mephimsexhay.com:8443
ursnif.mephimsexhay.com:80
ursnif.mephimsexhay.com:22
ursnif.mephimsexhay.com:8080
ursnif.mephimsexhay.com:8880
ursnif.mephimsexhay.com:2052
ursnif.mephimsexhay.com:2082
ursnif.mephimsexhay.com:2086
ursnif.mephimsexhay.com:2095
ursnif.mephimsexhay.com:443
ursnif.mephimsexhay.com:2053
ursnif.mephimsexhay.com:2083
ursnif.mephimsexhay.com:2087
ursnif.mephimsexhay.com:2096
ursnif.mephimsexhay.com:8443

Mutex

9Lx1oBXu85lk

Attributes

delay
0
install
true
install_file
jiggsw3.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  8e52485688de33fcbda3c59cd5c56edd0ca69525692fccfc9a1dd638ca58d5ed
- Size 45KB
- SHA256 8e52485688de33fcbda3c59cd5c56edd0ca69525692fccfc9a1dd638ca58d5ed
- MD5 81a43371aa1bae9fd3049d2191335ab5
- SHA1 084ffdb2fb1680370c7f2668b5eb4fbc087b2a3c
- SHA512 490160aa1096e34e14f5656f9d491a5dd0cc9538f912aa8ffe0d09c77a623939be69319905e6d25edbfe282dbdbeb4856c478d1ae6e1cde5486860881ad70f9b
- SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMITnyXaaPIYzjbWgX3ikvt7SavgfsBDZ8x:0u2vpTDe+2FEZY3bJXSEvYCd8x
- TLSH
  T1BA231A003BE9812BF2BF5F7899F26145867AF6632603D58D1CC011DB5713BC68A52AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2