asyncrat | 357be425cadc585662e468612b541fcd68465ed840c90dc17276665d34afbac6

Sharing

Copy URL Twitter E-mail

General

Target
357be425cadc585662e468612b541fcd68465ed840c90dc17276665d34afbac6
Size 45KB
Sample260714-s6jspsas9z
SHA256 357be425cadc585662e468612b541fcd68465ed840c90dc17276665d34afbac6
MD5 65b983ed6554cd30465382a8a2044761
SHA1 4c69dfca92f7a20b7f656a8dae514df142af77e5
SHA512 4db1b1231a9de9baacd2d804ec11a71e0f5054e285e873f400c103eb2420a8744b9ddb8d2f34a3564c19270ee7e2c7026f158036c2de08bd7f3ad1a06208fd8d
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY6iaLzwJAOPIcFzjbbgXCiRnrPvd3e9rBDZ0x:8uuSpTgyf2i5U23cF3bkXrRrPF6d0x
TLSH
T119233B0037E9822BF2BE4F789CF26145867AB2677603D58E1CC451DB5613FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s1.phimsexvn2.blog:80
s1.phimsexvn2.blog:22
s1.phimsexvn2.blog:8080
s1.phimsexvn2.blog:8880
s1.phimsexvn2.blog:2052
s1.phimsexvn2.blog:2082
s1.phimsexvn2.blog:2086
s1.phimsexvn2.blog:2095
s1.phimsexvn2.blog:443
s1.phimsexvn2.blog:2053
s1.phimsexvn2.blog:2083
s1.phimsexvn2.blog:2087
s1.phimsexvn2.blog:2096
s1.phimsexvn2.blog:8443
www.s1.phimsexvn2.blog:80
www.s1.phimsexvn2.blog:22
www.s1.phimsexvn2.blog:8080
www.s1.phimsexvn2.blog:8880
www.s1.phimsexvn2.blog:2052
www.s1.phimsexvn2.blog:2082
www.s1.phimsexvn2.blog:2086
www.s1.phimsexvn2.blog:2095
www.s1.phimsexvn2.blog:443
www.s1.phimsexvn2.blog:2053
www.s1.phimsexvn2.blog:2083
www.s1.phimsexvn2.blog:2087
www.s1.phimsexvn2.blog:2096
www.s1.phimsexvn2.blog:8443
klez.s1.phimsexvn2.blog:80
klez.s1.phimsexvn2.blog:22
klez.s1.phimsexvn2.blog:8080
klez.s1.phimsexvn2.blog:8880
klez.s1.phimsexvn2.blog:2052
klez.s1.phimsexvn2.blog:2082
klez.s1.phimsexvn2.blog:2086
klez.s1.phimsexvn2.blog:2095
klez.s1.phimsexvn2.blog:443
klez.s1.phimsexvn2.blog:2053
klez.s1.phimsexvn2.blog:2083
klez.s1.phimsexvn2.blog:2087
klez.s1.phimsexvn2.blog:2096
klez.s1.phimsexvn2.blog:8443
conficker.s1.phimsexvn2.blog:80
conficker.s1.phimsexvn2.blog:22
conficker.s1.phimsexvn2.blog:8080
conficker.s1.phimsexvn2.blog:8880
conficker.s1.phimsexvn2.blog:2052
conficker.s1.phimsexvn2.blog:2082
conficker.s1.phimsexvn2.blog:2086
conficker.s1.phimsexvn2.blog:2095
conficker.s1.phimsexvn2.blog:443
conficker.s1.phimsexvn2.blog:2053
conficker.s1.phimsexvn2.blog:2083
conficker.s1.phimsexvn2.blog:2087
conficker.s1.phimsexvn2.blog:2096
conficker.s1.phimsexvn2.blog:8443
remcos.s1.phimsexvn2.blog:80
remcos.s1.phimsexvn2.blog:22
remcos.s1.phimsexvn2.blog:8080
remcos.s1.phimsexvn2.blog:8880
remcos.s1.phimsexvn2.blog:2052
remcos.s1.phimsexvn2.blog:2082
remcos.s1.phimsexvn2.blog:2086
remcos.s1.phimsexvn2.blog:2095
remcos.s1.phimsexvn2.blog:443
remcos.s1.phimsexvn2.blog:2053
remcos.s1.phimsexvn2.blog:2083
remcos.s1.phimsexvn2.blog:2087
remcos.s1.phimsexvn2.blog:2096
remcos.s1.phimsexvn2.blog:8443

Mutex

QucdzBT6uHsy

Attributes

delay
0
install
true
install_file
stumao.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  357be425cadc585662e468612b541fcd68465ed840c90dc17276665d34afbac6
- Size 45KB
- SHA256 357be425cadc585662e468612b541fcd68465ed840c90dc17276665d34afbac6
- MD5 65b983ed6554cd30465382a8a2044761
- SHA1 4c69dfca92f7a20b7f656a8dae514df142af77e5
- SHA512 4db1b1231a9de9baacd2d804ec11a71e0f5054e285e873f400c103eb2420a8744b9ddb8d2f34a3564c19270ee7e2c7026f158036c2de08bd7f3ad1a06208fd8d
- SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY6iaLzwJAOPIcFzjbbgXCiRnrPvd3e9rBDZ0x:8uuSpTgyf2i5U23cF3bkXrRrPF6d0x
- TLSH
  T119233B0037E9822BF2BE4F789CF26145867AB2677603D58E1CC451DB5613FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2