asyncrat | 46293c516391450a53eaf72fa3c27ae6103ae9ccb2bfe8f7f7bd486a3f4c7caf

Sharing

Copy URL Twitter E-mail

General

Target
46293c516391450a53eaf72fa3c27ae6103ae9ccb2bfe8f7f7bd486a3f4c7caf
Size 45KB
Sample260712-v4tagaev5p
SHA256 46293c516391450a53eaf72fa3c27ae6103ae9ccb2bfe8f7f7bd486a3f4c7caf
MD5 e4ce811570f887a864ee2164371f65b6
SHA1 f2091b8050f9e81d63f4d269cce6df6e5603b39d
SHA512 98ef6f745ce2ec75eef7da4846cf6ed5a3dd6841a018259985d080f7ed7d4f11d5ae9f41b0dd91f6503cefc1ccd749f6dbec5f352aa5bedfe0de90b470be467a
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYNCXtTtoPIzzjb5gX3iVOFnkuBK5FqyUtuBDZ0x:8uuSpTgyf2lw3z3bWXSV9GKL/td0x
TLSH
T13A232A0037E8C12BF2BE5F7898F26245867AF6633603D59D1CC4419B5723FC69A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsexvn.work:80
phimsexvn.work:22
phimsexvn.work:8080
phimsexvn.work:8880
phimsexvn.work:2052
phimsexvn.work:2082
phimsexvn.work:2086
phimsexvn.work:2095
phimsexvn.work:443
phimsexvn.work:2053
phimsexvn.work:2083
phimsexvn.work:2087
phimsexvn.work:2096
phimsexvn.work:8443
www.phimsexvn.work:80
www.phimsexvn.work:22
www.phimsexvn.work:8080
www.phimsexvn.work:8880
www.phimsexvn.work:2052
www.phimsexvn.work:2082
www.phimsexvn.work:2086
www.phimsexvn.work:2095
www.phimsexvn.work:443
www.phimsexvn.work:2053
www.phimsexvn.work:2083
www.phimsexvn.work:2087
www.phimsexvn.work:2096
www.phimsexvn.work:8443
shamoon.phimsexvn.work:80
shamoon.phimsexvn.work:22
shamoon.phimsexvn.work:8080
shamoon.phimsexvn.work:8880
shamoon.phimsexvn.work:2052
shamoon.phimsexvn.work:2082
shamoon.phimsexvn.work:2086
shamoon.phimsexvn.work:2095
shamoon.phimsexvn.work:443
shamoon.phimsexvn.work:2053
shamoon.phimsexvn.work:2083
shamoon.phimsexvn.work:2087
shamoon.phimsexvn.work:2096
shamoon.phimsexvn.work:8443
blaster.phimsexvn.work:80
blaster.phimsexvn.work:22
blaster.phimsexvn.work:8080
blaster.phimsexvn.work:8880
blaster.phimsexvn.work:2052
blaster.phimsexvn.work:2082
blaster.phimsexvn.work:2086
blaster.phimsexvn.work:2095
blaster.phimsexvn.work:443
blaster.phimsexvn.work:2053
blaster.phimsexvn.work:2083
blaster.phimsexvn.work:2087
blaster.phimsexvn.work:2096
blaster.phimsexvn.work:8443
lokibot.phimsexvn.work:80
lokibot.phimsexvn.work:22
lokibot.phimsexvn.work:8080
lokibot.phimsexvn.work:8880
lokibot.phimsexvn.work:2052
lokibot.phimsexvn.work:2082
lokibot.phimsexvn.work:2086
lokibot.phimsexvn.work:2095
lokibot.phimsexvn.work:443
lokibot.phimsexvn.work:2053
lokibot.phimsexvn.work:2083
lokibot.phimsexvn.work:2087
lokibot.phimsexvn.work:2096
lokibot.phimsexvn.work:8443
connect.phimsexvn.work:80
connect.phimsexvn.work:22
connect.phimsexvn.work:8080
connect.phimsexvn.work:8880
connect.phimsexvn.work:2052
connect.phimsexvn.work:2082
connect.phimsexvn.work:2086
connect.phimsexvn.work:2095
connect.phimsexvn.work:443
connect.phimsexvn.work:2053
connect.phimsexvn.work:2083
connect.phimsexvn.work:2087
connect.phimsexvn.work:2096
connect.phimsexvn.work:8443

Mutex

ZtFhIettd9ns

Attributes

delay
0
install
true
install_file
5zwc91.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  46293c516391450a53eaf72fa3c27ae6103ae9ccb2bfe8f7f7bd486a3f4c7caf
- Size 45KB
- SHA256 46293c516391450a53eaf72fa3c27ae6103ae9ccb2bfe8f7f7bd486a3f4c7caf
- MD5 e4ce811570f887a864ee2164371f65b6
- SHA1 f2091b8050f9e81d63f4d269cce6df6e5603b39d
- SHA512 98ef6f745ce2ec75eef7da4846cf6ed5a3dd6841a018259985d080f7ed7d4f11d5ae9f41b0dd91f6503cefc1ccd749f6dbec5f352aa5bedfe0de90b470be467a
- SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYNCXtTtoPIzzjb5gX3iVOFnkuBK5FqyUtuBDZ0x:8uuSpTgyf2lw3z3bWXSV9GKL/td0x
- TLSH
  T13A232A0037E8C12BF2BE5F7898F26245867AF6633603D59D1CC4419B5723FC69A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2