asyncrat | 35fb354ef28b43030748c61cb8ef68354a55cd3b13fd055491d2338b99e3b1e3

Sharing

Copy URL Twitter E-mail

General

Target
35fb354ef28b43030748c61cb8ef68354a55cd3b13fd055491d2338b99e3b1e3
Size 45KB
Sample260715-pkgjnscs8p
SHA256 35fb354ef28b43030748c61cb8ef68354a55cd3b13fd055491d2338b99e3b1e3
MD5 c66da685746af413d450e7af48369a32
SHA1 e3de404da38ac3279038e0d252d26dc589c50a18
SHA512 8c6784a7fb3fcad663feeda36e8cc65a183f372f9e938090c32aae3878248fee5bc61e96f85e53353681ffb608e601769018a853d1e1a423a1818e98ce2f59e2
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qABw0Q+KXPIrzjbGgX3ijnjjHwIPZra5xBDZcx:UuKWgSJTwRf2Z9r3bZXSjfwMredcx
TLSH
T1A7231A003BD9812BF2BE4FB8ACF26145867AF6633603D5496CC451DB5A23BC6C6426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lephimsexviet.com:80
lephimsexviet.com:22
lephimsexviet.com:8080
lephimsexviet.com:8880
lephimsexviet.com:2052
lephimsexviet.com:2082
lephimsexviet.com:2086
lephimsexviet.com:2095
lephimsexviet.com:443
lephimsexviet.com:2053
lephimsexviet.com:2083
lephimsexviet.com:2087
lephimsexviet.com:2096
lephimsexviet.com:8443
www.lephimsexviet.com:80
www.lephimsexviet.com:22
www.lephimsexviet.com:8080
www.lephimsexviet.com:8880
www.lephimsexviet.com:2052
www.lephimsexviet.com:2082
www.lephimsexviet.com:2086
www.lephimsexviet.com:2095
www.lephimsexviet.com:443
www.lephimsexviet.com:2053
www.lephimsexviet.com:2083
www.lephimsexviet.com:2087
www.lephimsexviet.com:2096
www.lephimsexviet.com:8443
codered.lephimsexviet.com:80
codered.lephimsexviet.com:22
codered.lephimsexviet.com:8080
codered.lephimsexviet.com:8880
codered.lephimsexviet.com:2052
codered.lephimsexviet.com:2082
codered.lephimsexviet.com:2086
codered.lephimsexviet.com:2095
codered.lephimsexviet.com:443
codered.lephimsexviet.com:2053
codered.lephimsexviet.com:2083
codered.lephimsexviet.com:2087
codered.lephimsexviet.com:2096
codered.lephimsexviet.com:8443
remcos.lephimsexviet.com:80
remcos.lephimsexviet.com:22
remcos.lephimsexviet.com:8080
remcos.lephimsexviet.com:8880
remcos.lephimsexviet.com:2052
remcos.lephimsexviet.com:2082
remcos.lephimsexviet.com:2086
remcos.lephimsexviet.com:2095
remcos.lephimsexviet.com:443
remcos.lephimsexviet.com:2053
remcos.lephimsexviet.com:2083
remcos.lephimsexviet.com:2087
remcos.lephimsexviet.com:2096
remcos.lephimsexviet.com:8443
zbot.lephimsexviet.com:80
zbot.lephimsexviet.com:22
zbot.lephimsexviet.com:8080
zbot.lephimsexviet.com:8880
zbot.lephimsexviet.com:2052
zbot.lephimsexviet.com:2082
zbot.lephimsexviet.com:2086
zbot.lephimsexviet.com:2095
zbot.lephimsexviet.com:443
zbot.lephimsexviet.com:2053
zbot.lephimsexviet.com:2083
zbot.lephimsexviet.com:2087
zbot.lephimsexviet.com:2096
zbot.lephimsexviet.com:8443

Mutex

UlqfB8VB5rs0

Attributes

delay
0
install
true
install_file
f2rs9bh2.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  35fb354ef28b43030748c61cb8ef68354a55cd3b13fd055491d2338b99e3b1e3
- Size 45KB
- SHA256 35fb354ef28b43030748c61cb8ef68354a55cd3b13fd055491d2338b99e3b1e3
- MD5 c66da685746af413d450e7af48369a32
- SHA1 e3de404da38ac3279038e0d252d26dc589c50a18
- SHA512 8c6784a7fb3fcad663feeda36e8cc65a183f372f9e938090c32aae3878248fee5bc61e96f85e53353681ffb608e601769018a853d1e1a423a1818e98ce2f59e2
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qABw0Q+KXPIrzjbGgX3ijnjjHwIPZra5xBDZcx:UuKWgSJTwRf2Z9r3bZXSjfwMredcx
- TLSH
  T1A7231A003BD9812BF2BE4FB8ACF26145867AF6633603D5496CC451DB5A23BC6C6426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2