asyncrat | 4846b5ef2a5a1eea2b54ed3c5dced19befd4dd63381a0271e7b4225046b2aa2a

Sharing

Copy URL Twitter E-mail

General

Target
4846b5ef2a5a1eea2b54ed3c5dced19befd4dd63381a0271e7b4225046b2aa2a
Size 45KB
Sample260712-qvlf2scy41
SHA256 4846b5ef2a5a1eea2b54ed3c5dced19befd4dd63381a0271e7b4225046b2aa2a
MD5 12872597d2f40c41d5fbf05d69b86d0c
SHA1 58fbf8f62a5b43f0e4e33a6d96f813c58a4eba1d
SHA512 39efd2590eaf378f945c8f3408c174dfae0593750458b093889ab5949eb5589c3cba8128f895793f19f2584e7080e3883f7b3d7be8ccfbe05ff3fe1c507c476e
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qABw0Q+KXPIGzjblgX3iSsQjRDx7P02TY7DBDZcx:UuKWgSJTwRf2Z9G3biXSSljD7P00Ypde
TLSH
T197232C003BE8C13BF2BE4BB858F26145867BF6636603D5496CC4519B5723FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexhay.com:80
mephimsexhay.com:22
mephimsexhay.com:8080
mephimsexhay.com:8880
mephimsexhay.com:2052
mephimsexhay.com:2082
mephimsexhay.com:2086
mephimsexhay.com:2095
mephimsexhay.com:443
mephimsexhay.com:2053
mephimsexhay.com:2083
mephimsexhay.com:2087
mephimsexhay.com:2096
mephimsexhay.com:8443
www.mephimsexhay.com:80
www.mephimsexhay.com:22
www.mephimsexhay.com:8080
www.mephimsexhay.com:8880
www.mephimsexhay.com:2052
www.mephimsexhay.com:2082
www.mephimsexhay.com:2086
www.mephimsexhay.com:2095
www.mephimsexhay.com:443
www.mephimsexhay.com:2053
www.mephimsexhay.com:2083
www.mephimsexhay.com:2087
www.mephimsexhay.com:2096
www.mephimsexhay.com:8443
remcos.mephimsexhay.com:80
remcos.mephimsexhay.com:22
remcos.mephimsexhay.com:8080
remcos.mephimsexhay.com:8880
remcos.mephimsexhay.com:2052
remcos.mephimsexhay.com:2082
remcos.mephimsexhay.com:2086
remcos.mephimsexhay.com:2095
remcos.mephimsexhay.com:443
remcos.mephimsexhay.com:2053
remcos.mephimsexhay.com:2083
remcos.mephimsexhay.com:2087
remcos.mephimsexhay.com:2096
remcos.mephimsexhay.com:8443
invasive.mephimsexhay.com:80
invasive.mephimsexhay.com:22
invasive.mephimsexhay.com:8080
invasive.mephimsexhay.com:8880
invasive.mephimsexhay.com:2052
invasive.mephimsexhay.com:2082
invasive.mephimsexhay.com:2086
invasive.mephimsexhay.com:2095
invasive.mephimsexhay.com:443
invasive.mephimsexhay.com:2053
invasive.mephimsexhay.com:2083
invasive.mephimsexhay.com:2087
invasive.mephimsexhay.com:2096
invasive.mephimsexhay.com:8443
blaster.mephimsexhay.com:80
blaster.mephimsexhay.com:22
blaster.mephimsexhay.com:8080
blaster.mephimsexhay.com:8880
blaster.mephimsexhay.com:2052
blaster.mephimsexhay.com:2082
blaster.mephimsexhay.com:2086
blaster.mephimsexhay.com:2095
blaster.mephimsexhay.com:443
blaster.mephimsexhay.com:2053
blaster.mephimsexhay.com:2083
blaster.mephimsexhay.com:2087
blaster.mephimsexhay.com:2096
blaster.mephimsexhay.com:8443

Mutex

MtVnMBTWS8Cm

Attributes

delay
0
install
true
install_file
f4zfy5m2.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4846b5ef2a5a1eea2b54ed3c5dced19befd4dd63381a0271e7b4225046b2aa2a
- Size 45KB
- SHA256 4846b5ef2a5a1eea2b54ed3c5dced19befd4dd63381a0271e7b4225046b2aa2a
- MD5 12872597d2f40c41d5fbf05d69b86d0c
- SHA1 58fbf8f62a5b43f0e4e33a6d96f813c58a4eba1d
- SHA512 39efd2590eaf378f945c8f3408c174dfae0593750458b093889ab5949eb5589c3cba8128f895793f19f2584e7080e3883f7b3d7be8ccfbe05ff3fe1c507c476e
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qABw0Q+KXPIGzjblgX3iSsQjRDx7P02TY7DBDZcx:UuKWgSJTwRf2Z9G3biXSSljD7P00Ypde
- TLSH
  T197232C003BE8C13BF2BE4BB858F26145867BF6636603D5496CC4519B5723FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2