asyncrat | aac84ff2014f7f562f5fc1d00090741fd663dfa49945e5fe91ab5161a1e680d3

Sharing

Copy URL Twitter E-mail

General

Target
aac84ff2014f7f562f5fc1d00090741fd663dfa49945e5fe91ab5161a1e680d3
Size 45KB
Sample260714-n5vflaet2v
SHA256 aac84ff2014f7f562f5fc1d00090741fd663dfa49945e5fe91ab5161a1e680d3
MD5 c51360d352091e22590d3bba2c3e9c96
SHA1 afc739f8a8ca367e0daa97f64aa37764fa6c2579
SHA512 f8f31a8191c281d2b6aae49b6952a1ea3893d9c69e0f0ba2a0f10f92b4b89a21873cca4b9f0a990979834ba37bf031a6294f246788da46a31f771a5abe4b556c
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFKNd3u40cMOPI08zjbYgXvitbiTmFYG66Zyq3LBDZW:cu7e5TH2A2R8+M3083bPXKtbiTZG6PqS
TLSH
T1CB233B003BE9812BF2BE4F78ADF26145867AF2672603D94E1CC411DB4613FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s1.phimsexvn2.blog:80
s1.phimsexvn2.blog:22
s1.phimsexvn2.blog:8080
s1.phimsexvn2.blog:8880
s1.phimsexvn2.blog:2052
s1.phimsexvn2.blog:2082
s1.phimsexvn2.blog:2086
s1.phimsexvn2.blog:2095
s1.phimsexvn2.blog:443
s1.phimsexvn2.blog:2053
s1.phimsexvn2.blog:2083
s1.phimsexvn2.blog:2087
s1.phimsexvn2.blog:2096
s1.phimsexvn2.blog:8443
www.s1.phimsexvn2.blog:80
www.s1.phimsexvn2.blog:22
www.s1.phimsexvn2.blog:8080
www.s1.phimsexvn2.blog:8880
www.s1.phimsexvn2.blog:2052
www.s1.phimsexvn2.blog:2082
www.s1.phimsexvn2.blog:2086
www.s1.phimsexvn2.blog:2095
www.s1.phimsexvn2.blog:443
www.s1.phimsexvn2.blog:2053
www.s1.phimsexvn2.blog:2083
www.s1.phimsexvn2.blog:2087
www.s1.phimsexvn2.blog:2096
www.s1.phimsexvn2.blog:8443
conti.s1.phimsexvn2.blog:80
conti.s1.phimsexvn2.blog:22
conti.s1.phimsexvn2.blog:8080
conti.s1.phimsexvn2.blog:8880
conti.s1.phimsexvn2.blog:2052
conti.s1.phimsexvn2.blog:2082
conti.s1.phimsexvn2.blog:2086
conti.s1.phimsexvn2.blog:2095
conti.s1.phimsexvn2.blog:443
conti.s1.phimsexvn2.blog:2053
conti.s1.phimsexvn2.blog:2083
conti.s1.phimsexvn2.blog:2087
conti.s1.phimsexvn2.blog:2096
conti.s1.phimsexvn2.blog:8443
ursnif.s1.phimsexvn2.blog:80
ursnif.s1.phimsexvn2.blog:22
ursnif.s1.phimsexvn2.blog:8080
ursnif.s1.phimsexvn2.blog:8880
ursnif.s1.phimsexvn2.blog:2052
ursnif.s1.phimsexvn2.blog:2082
ursnif.s1.phimsexvn2.blog:2086
ursnif.s1.phimsexvn2.blog:2095
ursnif.s1.phimsexvn2.blog:443
ursnif.s1.phimsexvn2.blog:2053
ursnif.s1.phimsexvn2.blog:2083
ursnif.s1.phimsexvn2.blog:2087
ursnif.s1.phimsexvn2.blog:2096
ursnif.s1.phimsexvn2.blog:8443

Mutex

5zVTm1DT83Pw

Attributes

delay
0
install
true
install_file
3yf1q.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  aac84ff2014f7f562f5fc1d00090741fd663dfa49945e5fe91ab5161a1e680d3
- Size 45KB
- SHA256 aac84ff2014f7f562f5fc1d00090741fd663dfa49945e5fe91ab5161a1e680d3
- MD5 c51360d352091e22590d3bba2c3e9c96
- SHA1 afc739f8a8ca367e0daa97f64aa37764fa6c2579
- SHA512 f8f31a8191c281d2b6aae49b6952a1ea3893d9c69e0f0ba2a0f10f92b4b89a21873cca4b9f0a990979834ba37bf031a6294f246788da46a31f771a5abe4b556c
- SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFKNd3u40cMOPI08zjbYgXvitbiTmFYG66Zyq3LBDZW:cu7e5TH2A2R8+M3083bPXKtbiTZG6PqS
- TLSH
  T1CB233B003BE9812BF2BE4F78ADF26145867AF2672603D94E1CC411DB4613FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2