asyncrat | 04a40a902ded99e28ddcabaaacfaf072457d362e7ec1528dc932c2b4af02e187

Sharing

Copy URL Twitter E-mail

General

Target
04a40a902ded99e28ddcabaaacfaf072457d362e7ec1528dc932c2b4af02e187
Size 45KB
Sample260715-p5vxssfz91
SHA256 04a40a902ded99e28ddcabaaacfaf072457d362e7ec1528dc932c2b4af02e187
MD5 62cb54d9bbfa4196ed0a5f4696ce7a6e
SHA1 72de40f7646a6c99180edc15d0c5d50fcc5c6c61
SHA512 82a85fe6922920ee3086400cc62bf0063d1de7842b7e72d07cf46fffbc2925f27ca7baf4beec0a3a23cead8d03fac3ee1ca34a61238ae7dea3fa2258c117f0a5
SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbx/NYssPJZOPIczzjbygX/iYHt8WX/nBDZcx:Du2M5TQif2EHIf3cz3b1X6rWX5dcx
TLSH
T120231B103BE8823BF2BE4F78ACF26145467AB6632603D58E1CC451D75613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s1.phimsexvn2.blog:80
s1.phimsexvn2.blog:22
s1.phimsexvn2.blog:8080
s1.phimsexvn2.blog:8880
s1.phimsexvn2.blog:2052
s1.phimsexvn2.blog:2082
s1.phimsexvn2.blog:2086
s1.phimsexvn2.blog:2095
s1.phimsexvn2.blog:443
s1.phimsexvn2.blog:2053
s1.phimsexvn2.blog:2083
s1.phimsexvn2.blog:2087
s1.phimsexvn2.blog:2096
s1.phimsexvn2.blog:8443
www.s1.phimsexvn2.blog:80
www.s1.phimsexvn2.blog:22
www.s1.phimsexvn2.blog:8080
www.s1.phimsexvn2.blog:8880
www.s1.phimsexvn2.blog:2052
www.s1.phimsexvn2.blog:2082
www.s1.phimsexvn2.blog:2086
www.s1.phimsexvn2.blog:2095
www.s1.phimsexvn2.blog:443
www.s1.phimsexvn2.blog:2053
www.s1.phimsexvn2.blog:2083
www.s1.phimsexvn2.blog:2087
www.s1.phimsexvn2.blog:2096
www.s1.phimsexvn2.blog:8443
sobig.s1.phimsexvn2.blog:80
sobig.s1.phimsexvn2.blog:22
sobig.s1.phimsexvn2.blog:8080
sobig.s1.phimsexvn2.blog:8880
sobig.s1.phimsexvn2.blog:2052
sobig.s1.phimsexvn2.blog:2082
sobig.s1.phimsexvn2.blog:2086
sobig.s1.phimsexvn2.blog:2095
sobig.s1.phimsexvn2.blog:443
sobig.s1.phimsexvn2.blog:2053
sobig.s1.phimsexvn2.blog:2083
sobig.s1.phimsexvn2.blog:2087
sobig.s1.phimsexvn2.blog:2096
sobig.s1.phimsexvn2.blog:8443
blaster.s1.phimsexvn2.blog:80
blaster.s1.phimsexvn2.blog:22
blaster.s1.phimsexvn2.blog:8080
blaster.s1.phimsexvn2.blog:8880
blaster.s1.phimsexvn2.blog:2052
blaster.s1.phimsexvn2.blog:2082
blaster.s1.phimsexvn2.blog:2086
blaster.s1.phimsexvn2.blog:2095
blaster.s1.phimsexvn2.blog:443
blaster.s1.phimsexvn2.blog:2053
blaster.s1.phimsexvn2.blog:2083
blaster.s1.phimsexvn2.blog:2087
blaster.s1.phimsexvn2.blog:2096
blaster.s1.phimsexvn2.blog:8443
cryptolocker.s1.phimsexvn2.blog:80
cryptolocker.s1.phimsexvn2.blog:22
cryptolocker.s1.phimsexvn2.blog:8080
cryptolocker.s1.phimsexvn2.blog:8880
cryptolocker.s1.phimsexvn2.blog:2052
cryptolocker.s1.phimsexvn2.blog:2082
cryptolocker.s1.phimsexvn2.blog:2086
cryptolocker.s1.phimsexvn2.blog:2095
cryptolocker.s1.phimsexvn2.blog:443
cryptolocker.s1.phimsexvn2.blog:2053
cryptolocker.s1.phimsexvn2.blog:2083
cryptolocker.s1.phimsexvn2.blog:2087
cryptolocker.s1.phimsexvn2.blog:2096
cryptolocker.s1.phimsexvn2.blog:8443
lokibot.s1.phimsexvn2.blog:80
lokibot.s1.phimsexvn2.blog:22
lokibot.s1.phimsexvn2.blog:8080
lokibot.s1.phimsexvn2.blog:8880
lokibot.s1.phimsexvn2.blog:2052
lokibot.s1.phimsexvn2.blog:2082
lokibot.s1.phimsexvn2.blog:2086
lokibot.s1.phimsexvn2.blog:2095
lokibot.s1.phimsexvn2.blog:443
lokibot.s1.phimsexvn2.blog:2053
lokibot.s1.phimsexvn2.blog:2083
lokibot.s1.phimsexvn2.blog:2087
lokibot.s1.phimsexvn2.blog:2096
lokibot.s1.phimsexvn2.blog:8443

Mutex

TwGsHSUBadYx

Attributes

delay
0
install
true
install_file
mt5whq.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  04a40a902ded99e28ddcabaaacfaf072457d362e7ec1528dc932c2b4af02e187
- Size 45KB
- SHA256 04a40a902ded99e28ddcabaaacfaf072457d362e7ec1528dc932c2b4af02e187
- MD5 62cb54d9bbfa4196ed0a5f4696ce7a6e
- SHA1 72de40f7646a6c99180edc15d0c5d50fcc5c6c61
- SHA512 82a85fe6922920ee3086400cc62bf0063d1de7842b7e72d07cf46fffbc2925f27ca7baf4beec0a3a23cead8d03fac3ee1ca34a61238ae7dea3fa2258c117f0a5
- SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbx/NYssPJZOPIczzjbygX/iYHt8WX/nBDZcx:Du2M5TQif2EHIf3cz3b1X6rWX5dcx
- TLSH
  T120231B103BE8823BF2BE4F78ACF26145467AB6632603D58E1CC451D75613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2