asyncrat | 263bf3b468012525af224101181f7b64f04c91c0a33d7aaf6331c3d23dcc6991

Sharing

Copy URL Twitter E-mail

General

Target
263bf3b468012525af224101181f7b64f04c91c0a33d7aaf6331c3d23dcc6991
Size 45KB
Sample260715-pxc21sfz2x
SHA256 263bf3b468012525af224101181f7b64f04c91c0a33d7aaf6331c3d23dcc6991
MD5 d2898cd6afd737dd999ac74c3651d2e7
SHA1 36c2030d73d595e347a5925457f62b858462d5c3
SHA512 f34b282007063ea1c9bbc9373031e4812cae87613cf04a5cd3f77e132424ed886e1c9391e9ebd8c5ffefcb81dccd4e155e8b0641229542282331698b1c5a36d5
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AcQSCBznqNLPI7zjbOgX3iHYqbU1fO0rd0BDZsx:EufspTf2g2Jc9UqC73bxXSFGO0Cdsx
TLSH
T16E232C0077E8812BF2BE4F78A8F26145867AF6632603D54D2CC452DB5713FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lephimsexviet.com:80
lephimsexviet.com:22
lephimsexviet.com:8080
lephimsexviet.com:8880
lephimsexviet.com:2052
lephimsexviet.com:2082
lephimsexviet.com:2086
lephimsexviet.com:2095
lephimsexviet.com:443
lephimsexviet.com:2053
lephimsexviet.com:2083
lephimsexviet.com:2087
lephimsexviet.com:2096
lephimsexviet.com:8443
www.lephimsexviet.com:80
www.lephimsexviet.com:22
www.lephimsexviet.com:8080
www.lephimsexviet.com:8880
www.lephimsexviet.com:2052
www.lephimsexviet.com:2082
www.lephimsexviet.com:2086
www.lephimsexviet.com:2095
www.lephimsexviet.com:443
www.lephimsexviet.com:2053
www.lephimsexviet.com:2083
www.lephimsexviet.com:2087
www.lephimsexviet.com:2096
www.lephimsexviet.com:8443
zeus.lephimsexviet.com:80
zeus.lephimsexviet.com:22
zeus.lephimsexviet.com:8080
zeus.lephimsexviet.com:8880
zeus.lephimsexviet.com:2052
zeus.lephimsexviet.com:2082
zeus.lephimsexviet.com:2086
zeus.lephimsexviet.com:2095
zeus.lephimsexviet.com:443
zeus.lephimsexviet.com:2053
zeus.lephimsexviet.com:2083
zeus.lephimsexviet.com:2087
zeus.lephimsexviet.com:2096
zeus.lephimsexviet.com:8443
revil.lephimsexviet.com:80
revil.lephimsexviet.com:22
revil.lephimsexviet.com:8080
revil.lephimsexviet.com:8880
revil.lephimsexviet.com:2052
revil.lephimsexviet.com:2082
revil.lephimsexviet.com:2086
revil.lephimsexviet.com:2095
revil.lephimsexviet.com:443
revil.lephimsexviet.com:2053
revil.lephimsexviet.com:2083
revil.lephimsexviet.com:2087
revil.lephimsexviet.com:2096
revil.lephimsexviet.com:8443
hack.lephimsexviet.com:80
hack.lephimsexviet.com:22
hack.lephimsexviet.com:8080
hack.lephimsexviet.com:8880
hack.lephimsexviet.com:2052
hack.lephimsexviet.com:2082
hack.lephimsexviet.com:2086
hack.lephimsexviet.com:2095
hack.lephimsexviet.com:443
hack.lephimsexviet.com:2053
hack.lephimsexviet.com:2083
hack.lephimsexviet.com:2087
hack.lephimsexviet.com:2096
hack.lephimsexviet.com:8443

Mutex

b8pMB9mBEMcn

Attributes

delay
0
install
true
install_file
abssloz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  263bf3b468012525af224101181f7b64f04c91c0a33d7aaf6331c3d23dcc6991
- Size 45KB
- SHA256 263bf3b468012525af224101181f7b64f04c91c0a33d7aaf6331c3d23dcc6991
- MD5 d2898cd6afd737dd999ac74c3651d2e7
- SHA1 36c2030d73d595e347a5925457f62b858462d5c3
- SHA512 f34b282007063ea1c9bbc9373031e4812cae87613cf04a5cd3f77e132424ed886e1c9391e9ebd8c5ffefcb81dccd4e155e8b0641229542282331698b1c5a36d5
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AcQSCBznqNLPI7zjbOgX3iHYqbU1fO0rd0BDZsx:EufspTf2g2Jc9UqC73bxXSFGO0Cdsx
- TLSH
  T16E232C0077E8812BF2BE4F78A8F26145867AF6632603D54D2CC452DB5713FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2