asyncrat | fadda13a1304a26ab0d50bc85228d23bc6468d4df78015e0031668be4944c99a

Sharing

Copy URL Twitter E-mail

General

Target
fadda13a1304a26ab0d50bc85228d23bc6468d4df78015e0031668be4944c99a
Size 45KB
Sample260714-prbl1afv7v
SHA256 fadda13a1304a26ab0d50bc85228d23bc6468d4df78015e0031668be4944c99a
MD5 c8ed37a47931730926df84f6e599add3
SHA1 3cce96e6cee78a4f6c1b4d4b7f7b107d1f732894
SHA512 6010e6e12080855eb5c3efd77ed4ba84fd1236c491e15d7131464831ea92390774a93c3ee4e8bca4e1c9033d906dde5530cbc4ac48ea652548d909fdc1552fab
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4gozHyvCKPIiSjbDgX3iW96TWlOWbqhEnmNBDZ0x:8uUIpT4vAj25L5i+bcXSW99OiqumDd0x
TLSH
T11A232B0037E8C127F2BE4F789DF26145867EB6633A03D58A1CC452D71723BC69A526FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lephimsexviet.com:80
lephimsexviet.com:22
lephimsexviet.com:8080
lephimsexviet.com:8880
lephimsexviet.com:2052
lephimsexviet.com:2082
lephimsexviet.com:2086
lephimsexviet.com:2095
lephimsexviet.com:443
lephimsexviet.com:2053
lephimsexviet.com:2083
lephimsexviet.com:2087
lephimsexviet.com:2096
lephimsexviet.com:8443
www.lephimsexviet.com:80
www.lephimsexviet.com:22
www.lephimsexviet.com:8080
www.lephimsexviet.com:8880
www.lephimsexviet.com:2052
www.lephimsexviet.com:2082
www.lephimsexviet.com:2086
www.lephimsexviet.com:2095
www.lephimsexviet.com:443
www.lephimsexviet.com:2053
www.lephimsexviet.com:2083
www.lephimsexviet.com:2087
www.lephimsexviet.com:2096
www.lephimsexviet.com:8443
darkside.lephimsexviet.com:80
darkside.lephimsexviet.com:22
darkside.lephimsexviet.com:8080
darkside.lephimsexviet.com:8880
darkside.lephimsexviet.com:2052
darkside.lephimsexviet.com:2082
darkside.lephimsexviet.com:2086
darkside.lephimsexviet.com:2095
darkside.lephimsexviet.com:443
darkside.lephimsexviet.com:2053
darkside.lephimsexviet.com:2083
darkside.lephimsexviet.com:2087
darkside.lephimsexviet.com:2096
darkside.lephimsexviet.com:8443
klez.lephimsexviet.com:80
klez.lephimsexviet.com:22
klez.lephimsexviet.com:8080
klez.lephimsexviet.com:8880
klez.lephimsexviet.com:2052
klez.lephimsexviet.com:2082
klez.lephimsexviet.com:2086
klez.lephimsexviet.com:2095
klez.lephimsexviet.com:443
klez.lephimsexviet.com:2053
klez.lephimsexviet.com:2083
klez.lephimsexviet.com:2087
klez.lephimsexviet.com:2096
klez.lephimsexviet.com:8443
ursnif.lephimsexviet.com:80
ursnif.lephimsexviet.com:22
ursnif.lephimsexviet.com:8080
ursnif.lephimsexviet.com:8880
ursnif.lephimsexviet.com:2052
ursnif.lephimsexviet.com:2082
ursnif.lephimsexviet.com:2086
ursnif.lephimsexviet.com:2095
ursnif.lephimsexviet.com:443
ursnif.lephimsexviet.com:2053
ursnif.lephimsexviet.com:2083
ursnif.lephimsexviet.com:2087
ursnif.lephimsexviet.com:2096
ursnif.lephimsexviet.com:8443

Mutex

IFPriVovDVON

Attributes

delay
0
install
true
install_file
q79go3a.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  fadda13a1304a26ab0d50bc85228d23bc6468d4df78015e0031668be4944c99a
- Size 45KB
- SHA256 fadda13a1304a26ab0d50bc85228d23bc6468d4df78015e0031668be4944c99a
- MD5 c8ed37a47931730926df84f6e599add3
- SHA1 3cce96e6cee78a4f6c1b4d4b7f7b107d1f732894
- SHA512 6010e6e12080855eb5c3efd77ed4ba84fd1236c491e15d7131464831ea92390774a93c3ee4e8bca4e1c9033d906dde5530cbc4ac48ea652548d909fdc1552fab
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4gozHyvCKPIiSjbDgX3iW96TWlOWbqhEnmNBDZ0x:8uUIpT4vAj25L5i+bcXSW99OiqumDd0x
- TLSH
  T11A232B0037E8C127F2BE4F789DF26145867EB6633A03D58A1CC452D71723BC69A526FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2