asyncrat | 2ca321bdd3b57f58a5936a6f64f15a19c32b9f4124dfd68b707f869ae969f475

Sharing

Copy URL Twitter E-mail

General

Target
2ca321bdd3b57f58a5936a6f64f15a19c32b9f4124dfd68b707f869ae969f475
Size 45KB
Sample260714-t9z5jagy6k
SHA256 2ca321bdd3b57f58a5936a6f64f15a19c32b9f4124dfd68b707f869ae969f475
MD5 d61c6fec80d6859cbc430525db869d50
SHA1 2d46f9dfd17e3db6bdc18eb7b6c4eb2de9fe0635
SHA512 8c8f6fd4d27e2d580e913825bc97595660e7786257165cf72c655dfcbd694d98581e415f9c61ed35d2584c60470025c943f2eac072d3f9865c6da2cf83eccd23
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1w0b3NEAteiZPISzjbLgI3ilvp/AwRs6lNgGC2MNnj2:cuR0JTPjY2a3ehiWS3b0ISlvp/7zHJC0
TLSH
T1CA232B003BE8C12BF2BE4F78A9F26245467BF6633602D5491CC451DB5A13FC69A43AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lephimsexviet.com:80
lephimsexviet.com:22
lephimsexviet.com:8080
lephimsexviet.com:8880
lephimsexviet.com:2052
lephimsexviet.com:2082
lephimsexviet.com:2086
lephimsexviet.com:2095
lephimsexviet.com:443
lephimsexviet.com:2053
lephimsexviet.com:2083
lephimsexviet.com:2087
lephimsexviet.com:2096
lephimsexviet.com:8443
www.lephimsexviet.com:80
www.lephimsexviet.com:22
www.lephimsexviet.com:8080
www.lephimsexviet.com:8880
www.lephimsexviet.com:2052
www.lephimsexviet.com:2082
www.lephimsexviet.com:2086
www.lephimsexviet.com:2095
www.lephimsexviet.com:443
www.lephimsexviet.com:2053
www.lephimsexviet.com:2083
www.lephimsexviet.com:2087
www.lephimsexviet.com:2096
www.lephimsexviet.com:8443
trisis.lephimsexviet.com:80
trisis.lephimsexviet.com:22
trisis.lephimsexviet.com:8080
trisis.lephimsexviet.com:8880
trisis.lephimsexviet.com:2052
trisis.lephimsexviet.com:2082
trisis.lephimsexviet.com:2086
trisis.lephimsexviet.com:2095
trisis.lephimsexviet.com:443
trisis.lephimsexviet.com:2053
trisis.lephimsexviet.com:2083
trisis.lephimsexviet.com:2087
trisis.lephimsexviet.com:2096
trisis.lephimsexviet.com:8443
fakeupdates.lephimsexviet.com:80
fakeupdates.lephimsexviet.com:22
fakeupdates.lephimsexviet.com:8080
fakeupdates.lephimsexviet.com:8880
fakeupdates.lephimsexviet.com:2052
fakeupdates.lephimsexviet.com:2082
fakeupdates.lephimsexviet.com:2086
fakeupdates.lephimsexviet.com:2095
fakeupdates.lephimsexviet.com:443
fakeupdates.lephimsexviet.com:2053
fakeupdates.lephimsexviet.com:2083
fakeupdates.lephimsexviet.com:2087
fakeupdates.lephimsexviet.com:2096
fakeupdates.lephimsexviet.com:8443

Mutex

UkXTFAzH3vd5

Attributes

delay
0
install
true
install_file
tpdk.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2ca321bdd3b57f58a5936a6f64f15a19c32b9f4124dfd68b707f869ae969f475
- Size 45KB
- SHA256 2ca321bdd3b57f58a5936a6f64f15a19c32b9f4124dfd68b707f869ae969f475
- MD5 d61c6fec80d6859cbc430525db869d50
- SHA1 2d46f9dfd17e3db6bdc18eb7b6c4eb2de9fe0635
- SHA512 8c8f6fd4d27e2d580e913825bc97595660e7786257165cf72c655dfcbd694d98581e415f9c61ed35d2584c60470025c943f2eac072d3f9865c6da2cf83eccd23
- SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1w0b3NEAteiZPISzjbLgI3ilvp/AwRs6lNgGC2MNnj2:cuR0JTPjY2a3ehiWS3b0ISlvp/7zHJC0
- TLSH
  T1CA232B003BE8C12BF2BE4F78A9F26245467BF6633602D5491CC451DB5A13FC69A43AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2