asyncrat | 9c35059a55f69a561c7317cd8961154788adcb48d235a63d0397bca73dec5477

Sharing

Copy URL Twitter E-mail

General

Target
9c35059a55f69a561c7317cd8961154788adcb48d235a63d0397bca73dec5477
Size 45KB
Sample260716-gbfxsahs81
SHA256 9c35059a55f69a561c7317cd8961154788adcb48d235a63d0397bca73dec5477
MD5 f9d9006013eed764ee615914d84e20ad
SHA1 d5f2e452b73bedd46fcd622463dc5d0e48eca81e
SHA512 dd2d3c1eb160d10e1c57439eb0758bcdde311933d8749c105f86e54486f6bca8c2dedab71c96cb577766955241cd33d616b5e553ad6384a3d76d76c5780c928c
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAO8V1RpPEcPIMzjb9gX3iEuu9vurbk9BDZUx:cuqNJTLr62e8VDZEhM3bqXSEukvSkdUx
TLSH
T1B3232B0037E8822BF2BE4F78A8F25145867AF6636603D54A1CC451DB5713FC6CA526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimhot69.com:80
phimhot69.com:22
phimhot69.com:8080
phimhot69.com:8880
phimhot69.com:2052
phimhot69.com:2082
phimhot69.com:2086
phimhot69.com:2095
phimhot69.com:443
phimhot69.com:2053
phimhot69.com:2083
phimhot69.com:2087
phimhot69.com:2096
phimhot69.com:8443
www.phimhot69.com:80
www.phimhot69.com:22
www.phimhot69.com:8080
www.phimhot69.com:8880
www.phimhot69.com:2052
www.phimhot69.com:2082
www.phimhot69.com:2086
www.phimhot69.com:2095
www.phimhot69.com:443
www.phimhot69.com:2053
www.phimhot69.com:2083
www.phimhot69.com:2087
www.phimhot69.com:2096
www.phimhot69.com:8443
ryuk.phimhot69.com:80
ryuk.phimhot69.com:22
ryuk.phimhot69.com:8080
ryuk.phimhot69.com:8880
ryuk.phimhot69.com:2052
ryuk.phimhot69.com:2082
ryuk.phimhot69.com:2086
ryuk.phimhot69.com:2095
ryuk.phimhot69.com:443
ryuk.phimhot69.com:2053
ryuk.phimhot69.com:2083
ryuk.phimhot69.com:2087
ryuk.phimhot69.com:2096
ryuk.phimhot69.com:8443
fakeupdates.phimhot69.com:80
fakeupdates.phimhot69.com:22
fakeupdates.phimhot69.com:8080
fakeupdates.phimhot69.com:8880
fakeupdates.phimhot69.com:2052
fakeupdates.phimhot69.com:2082
fakeupdates.phimhot69.com:2086
fakeupdates.phimhot69.com:2095
fakeupdates.phimhot69.com:443
fakeupdates.phimhot69.com:2053
fakeupdates.phimhot69.com:2083
fakeupdates.phimhot69.com:2087
fakeupdates.phimhot69.com:2096
fakeupdates.phimhot69.com:8443
hermeticwiper.phimhot69.com:80
hermeticwiper.phimhot69.com:22
hermeticwiper.phimhot69.com:8080
hermeticwiper.phimhot69.com:8880
hermeticwiper.phimhot69.com:2052
hermeticwiper.phimhot69.com:2082
hermeticwiper.phimhot69.com:2086
hermeticwiper.phimhot69.com:2095
hermeticwiper.phimhot69.com:443
hermeticwiper.phimhot69.com:2053
hermeticwiper.phimhot69.com:2083
hermeticwiper.phimhot69.com:2087
hermeticwiper.phimhot69.com:2096
hermeticwiper.phimhot69.com:8443
socgholish.phimhot69.com:80
socgholish.phimhot69.com:22
socgholish.phimhot69.com:8080
socgholish.phimhot69.com:8880
socgholish.phimhot69.com:2052
socgholish.phimhot69.com:2082
socgholish.phimhot69.com:2086
socgholish.phimhot69.com:2095
socgholish.phimhot69.com:443
socgholish.phimhot69.com:2053
socgholish.phimhot69.com:2083
socgholish.phimhot69.com:2087
socgholish.phimhot69.com:2096
socgholish.phimhot69.com:8443

Mutex

sqqXc25xcdnx

Attributes

delay
0
install
true
install_file
b3gu.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  9c35059a55f69a561c7317cd8961154788adcb48d235a63d0397bca73dec5477
- Size 45KB
- SHA256 9c35059a55f69a561c7317cd8961154788adcb48d235a63d0397bca73dec5477
- MD5 f9d9006013eed764ee615914d84e20ad
- SHA1 d5f2e452b73bedd46fcd622463dc5d0e48eca81e
- SHA512 dd2d3c1eb160d10e1c57439eb0758bcdde311933d8749c105f86e54486f6bca8c2dedab71c96cb577766955241cd33d616b5e553ad6384a3d76d76c5780c928c
- SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAO8V1RpPEcPIMzjb9gX3iEuu9vurbk9BDZUx:cuqNJTLr62e8VDZEhM3bqXSEukvSkdUx
- TLSH
  T1B3232B0037E8822BF2BE4F78A8F25145867AF6636603D54A1CC451DB5713FC6CA526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2