asyncrat | adb733e0769a5add49b799ee485cb4f375a209e36cec40b9e1dd7a29c7402d04

Sharing

Copy URL Twitter E-mail

General

Target
adb733e0769a5add49b799ee485cb4f375a209e36cec40b9e1dd7a29c7402d04
Size 45KB
Sample260714-ny2lbsbx7m
SHA256 adb733e0769a5add49b799ee485cb4f375a209e36cec40b9e1dd7a29c7402d04
MD5 4bd586200e4ecd445c2d81234dd09ecd
SHA1 b786e994f7e04dd39466e4c935541608945f09fb
SHA512 026572eed3c94f702e36abba55e858bdb5bf632ed30c50cbcef0e112c5387d26daaaf8782d6bda5936ef48693bad2e5797ef271b0cefc59ca3225c0221eab48c
SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQNm/9GgrOPIRzjbCgX3ieD91ZSRv+5dBDZUx:cuqb5TrhG2Zm1b3R3blXSkZSRmldUx
TLSH
T1AE231B003BE8812BF2BE4F789CF26145867AF6677603D54E1CC4529B5613FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lephimsexhay.com:80
lephimsexhay.com:22
lephimsexhay.com:8080
lephimsexhay.com:8880
lephimsexhay.com:2052
lephimsexhay.com:2082
lephimsexhay.com:2086
lephimsexhay.com:2095
lephimsexhay.com:443
lephimsexhay.com:2053
lephimsexhay.com:2083
lephimsexhay.com:2087
lephimsexhay.com:2096
lephimsexhay.com:8443
www.lephimsexhay.com:80
www.lephimsexhay.com:22
www.lephimsexhay.com:8080
www.lephimsexhay.com:8880
www.lephimsexhay.com:2052
www.lephimsexhay.com:2082
www.lephimsexhay.com:2086
www.lephimsexhay.com:2095
www.lephimsexhay.com:443
www.lephimsexhay.com:2053
www.lephimsexhay.com:2083
www.lephimsexhay.com:2087
www.lephimsexhay.com:2096
www.lephimsexhay.com:8443
notpetya.lephimsexhay.com:80
notpetya.lephimsexhay.com:22
notpetya.lephimsexhay.com:8080
notpetya.lephimsexhay.com:8880
notpetya.lephimsexhay.com:2052
notpetya.lephimsexhay.com:2082
notpetya.lephimsexhay.com:2086
notpetya.lephimsexhay.com:2095
notpetya.lephimsexhay.com:443
notpetya.lephimsexhay.com:2053
notpetya.lephimsexhay.com:2083
notpetya.lephimsexhay.com:2087
notpetya.lephimsexhay.com:2096
notpetya.lephimsexhay.com:8443
locky.lephimsexhay.com:80
locky.lephimsexhay.com:22
locky.lephimsexhay.com:8080
locky.lephimsexhay.com:8880
locky.lephimsexhay.com:2052
locky.lephimsexhay.com:2082
locky.lephimsexhay.com:2086
locky.lephimsexhay.com:2095
locky.lephimsexhay.com:443
locky.lephimsexhay.com:2053
locky.lephimsexhay.com:2083
locky.lephimsexhay.com:2087
locky.lephimsexhay.com:2096
locky.lephimsexhay.com:8443
emotet.lephimsexhay.com:80
emotet.lephimsexhay.com:22
emotet.lephimsexhay.com:8080
emotet.lephimsexhay.com:8880
emotet.lephimsexhay.com:2052
emotet.lephimsexhay.com:2082
emotet.lephimsexhay.com:2086
emotet.lephimsexhay.com:2095
emotet.lephimsexhay.com:443
emotet.lephimsexhay.com:2053
emotet.lephimsexhay.com:2083
emotet.lephimsexhay.com:2087
emotet.lephimsexhay.com:2096
emotet.lephimsexhay.com:8443
qbot.lephimsexhay.com:80
qbot.lephimsexhay.com:22
qbot.lephimsexhay.com:8080
qbot.lephimsexhay.com:8880
qbot.lephimsexhay.com:2052
qbot.lephimsexhay.com:2082
qbot.lephimsexhay.com:2086
qbot.lephimsexhay.com:2095
qbot.lephimsexhay.com:443
qbot.lephimsexhay.com:2053
qbot.lephimsexhay.com:2083
qbot.lephimsexhay.com:2087
qbot.lephimsexhay.com:2096
qbot.lephimsexhay.com:8443

Mutex

IUv0iH87vNvV

Attributes

delay
0
install
true
install_file
m272g.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  adb733e0769a5add49b799ee485cb4f375a209e36cec40b9e1dd7a29c7402d04
- Size 45KB
- SHA256 adb733e0769a5add49b799ee485cb4f375a209e36cec40b9e1dd7a29c7402d04
- MD5 4bd586200e4ecd445c2d81234dd09ecd
- SHA1 b786e994f7e04dd39466e4c935541608945f09fb
- SHA512 026572eed3c94f702e36abba55e858bdb5bf632ed30c50cbcef0e112c5387d26daaaf8782d6bda5936ef48693bad2e5797ef271b0cefc59ca3225c0221eab48c
- SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQNm/9GgrOPIRzjbCgX3ieD91ZSRv+5dBDZUx:cuqb5TrhG2Zm1b3R3blXSkZSRmldUx
- TLSH
  T1AE231B003BE8812BF2BE4F789CF26145867AF6677603D54E1CC4529B5613FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2