asyncrat | 301ce84df7412de5485145455931dd7076362ee8d319503cf6bb9a58fd7d2673

Sharing

Copy URL Twitter E-mail

General

Target
301ce84df7412de5485145455931dd7076362ee8d319503cf6bb9a58fd7d2673
Size 45KB
Sample260715-nlbjdaaz5p
SHA256 301ce84df7412de5485145455931dd7076362ee8d319503cf6bb9a58fd7d2673
MD5 d2ec2a96f6addffd80d7de9577b6a6c1
SHA1 88acafbde9cd2b0b45353b547b6012407ec7a44b
SHA512 e04e9e00fa448e12a67df6a0c3857b3a9e046ff12e19f9bd7bc221261995f141cee6cf85fa98142fbf102b3f1383b110506f3d21cead3bede96ed1193613d8b4
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVD0ewUkA1MiZPI7zjbtgE3i/vS9extj1tSMWKc4qEm:MuBGJTPho2iwvDiW73b6ES/gojHgNjyE
TLSH
T18B231A003BE9812BF2BE4B7868F26145867BF6633603D54D1CC451DB5A13FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexphimhayw.pro:80
sexphimhayw.pro:22
sexphimhayw.pro:8080
sexphimhayw.pro:8880
sexphimhayw.pro:2052
sexphimhayw.pro:2082
sexphimhayw.pro:2086
sexphimhayw.pro:2095
sexphimhayw.pro:443
sexphimhayw.pro:2053
sexphimhayw.pro:2083
sexphimhayw.pro:2087
sexphimhayw.pro:2096
sexphimhayw.pro:8443
www.sexphimhayw.pro:80
www.sexphimhayw.pro:22
www.sexphimhayw.pro:8080
www.sexphimhayw.pro:8880
www.sexphimhayw.pro:2052
www.sexphimhayw.pro:2082
www.sexphimhayw.pro:2086
www.sexphimhayw.pro:2095
www.sexphimhayw.pro:443
www.sexphimhayw.pro:2053
www.sexphimhayw.pro:2083
www.sexphimhayw.pro:2087
www.sexphimhayw.pro:2096
www.sexphimhayw.pro:8443
shamoon.sexphimhayw.pro:80
shamoon.sexphimhayw.pro:22
shamoon.sexphimhayw.pro:8080
shamoon.sexphimhayw.pro:8880
shamoon.sexphimhayw.pro:2052
shamoon.sexphimhayw.pro:2082
shamoon.sexphimhayw.pro:2086
shamoon.sexphimhayw.pro:2095
shamoon.sexphimhayw.pro:443
shamoon.sexphimhayw.pro:2053
shamoon.sexphimhayw.pro:2083
shamoon.sexphimhayw.pro:2087
shamoon.sexphimhayw.pro:2096
shamoon.sexphimhayw.pro:8443
trickbot.sexphimhayw.pro:80
trickbot.sexphimhayw.pro:22
trickbot.sexphimhayw.pro:8080
trickbot.sexphimhayw.pro:8880
trickbot.sexphimhayw.pro:2052
trickbot.sexphimhayw.pro:2082
trickbot.sexphimhayw.pro:2086
trickbot.sexphimhayw.pro:2095
trickbot.sexphimhayw.pro:443
trickbot.sexphimhayw.pro:2053
trickbot.sexphimhayw.pro:2083
trickbot.sexphimhayw.pro:2087
trickbot.sexphimhayw.pro:2096
trickbot.sexphimhayw.pro:8443
iloveyou.sexphimhayw.pro:80
iloveyou.sexphimhayw.pro:22
iloveyou.sexphimhayw.pro:8080
iloveyou.sexphimhayw.pro:8880
iloveyou.sexphimhayw.pro:2052
iloveyou.sexphimhayw.pro:2082
iloveyou.sexphimhayw.pro:2086
iloveyou.sexphimhayw.pro:2095
iloveyou.sexphimhayw.pro:443
iloveyou.sexphimhayw.pro:2053
iloveyou.sexphimhayw.pro:2083
iloveyou.sexphimhayw.pro:2087
iloveyou.sexphimhayw.pro:2096
iloveyou.sexphimhayw.pro:8443

Mutex

T4Fp7cmBOhg4

Attributes

delay
0
install
true
install_file
zvgh.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  301ce84df7412de5485145455931dd7076362ee8d319503cf6bb9a58fd7d2673
- Size 45KB
- SHA256 301ce84df7412de5485145455931dd7076362ee8d319503cf6bb9a58fd7d2673
- MD5 d2ec2a96f6addffd80d7de9577b6a6c1
- SHA1 88acafbde9cd2b0b45353b547b6012407ec7a44b
- SHA512 e04e9e00fa448e12a67df6a0c3857b3a9e046ff12e19f9bd7bc221261995f141cee6cf85fa98142fbf102b3f1383b110506f3d21cead3bede96ed1193613d8b4
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVD0ewUkA1MiZPI7zjbtgE3i/vS9extj1tSMWKc4qEm:MuBGJTPho2iwvDiW73b6ES/gojHgNjyE
- TLSH
  T18B231A003BE9812BF2BE4B7868F26145867BF6633603D54D1CC451DB5A13FC69A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2