asyncrat | ca36f0e2f8c3e1a0d9e6d3056ee0d2533ae588081112f893f99df894296a312a

Sharing

Copy URL Twitter E-mail

General

Target
ca36f0e2f8c3e1a0d9e6d3056ee0d2533ae588081112f893f99df894296a312a
Size 45KB
Sample260716-qca8csdz7j
SHA256 ca36f0e2f8c3e1a0d9e6d3056ee0d2533ae588081112f893f99df894296a312a
MD5 4d097dbd98b9909fa394843d9c0bdf91
SHA1 d177ba65bb28b80381680bd97bf771893d2dfacd
SHA512 5ca93030939b01a3fe5bf4db1475ba39aa981e98a7696f88071c75c0ad884816ed99e3b4873eb8b7aecebe3f3762f1b57dbbcbdb7e0de876818ce378a6d0a8e8
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYCDEbHB0jrOPI/izjbBgX3i6So4oqrF4BDZ0x:8uuSpTgyf2qySf3/i3buXS6SodqJ+d0x
TLSH
T1802309003BE8C127F2BE4F78A9F26145467EF6633603E6491CC451DB5623FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexnhatban.com:80
fimsexnhatban.com:22
fimsexnhatban.com:8080
fimsexnhatban.com:8880
fimsexnhatban.com:2052
fimsexnhatban.com:2082
fimsexnhatban.com:2086
fimsexnhatban.com:2095
fimsexnhatban.com:443
fimsexnhatban.com:2053
fimsexnhatban.com:2083
fimsexnhatban.com:2087
fimsexnhatban.com:2096
fimsexnhatban.com:8443
www.fimsexnhatban.com:80
www.fimsexnhatban.com:22
www.fimsexnhatban.com:8080
www.fimsexnhatban.com:8880
www.fimsexnhatban.com:2052
www.fimsexnhatban.com:2082
www.fimsexnhatban.com:2086
www.fimsexnhatban.com:2095
www.fimsexnhatban.com:443
www.fimsexnhatban.com:2053
www.fimsexnhatban.com:2083
www.fimsexnhatban.com:2087
www.fimsexnhatban.com:2096
www.fimsexnhatban.com:8443
hermeticwiper.fimsexnhatban.com:80
hermeticwiper.fimsexnhatban.com:22
hermeticwiper.fimsexnhatban.com:8080
hermeticwiper.fimsexnhatban.com:8880
hermeticwiper.fimsexnhatban.com:2052
hermeticwiper.fimsexnhatban.com:2082
hermeticwiper.fimsexnhatban.com:2086
hermeticwiper.fimsexnhatban.com:2095
hermeticwiper.fimsexnhatban.com:443
hermeticwiper.fimsexnhatban.com:2053
hermeticwiper.fimsexnhatban.com:2083
hermeticwiper.fimsexnhatban.com:2087
hermeticwiper.fimsexnhatban.com:2096
hermeticwiper.fimsexnhatban.com:8443
gh0st.fimsexnhatban.com:80
gh0st.fimsexnhatban.com:22
gh0st.fimsexnhatban.com:8080
gh0st.fimsexnhatban.com:8880
gh0st.fimsexnhatban.com:2052
gh0st.fimsexnhatban.com:2082
gh0st.fimsexnhatban.com:2086
gh0st.fimsexnhatban.com:2095
gh0st.fimsexnhatban.com:443
gh0st.fimsexnhatban.com:2053
gh0st.fimsexnhatban.com:2083
gh0st.fimsexnhatban.com:2087
gh0st.fimsexnhatban.com:2096
gh0st.fimsexnhatban.com:8443
trisis.fimsexnhatban.com:80
trisis.fimsexnhatban.com:22
trisis.fimsexnhatban.com:8080
trisis.fimsexnhatban.com:8880
trisis.fimsexnhatban.com:2052
trisis.fimsexnhatban.com:2082
trisis.fimsexnhatban.com:2086
trisis.fimsexnhatban.com:2095
trisis.fimsexnhatban.com:443
trisis.fimsexnhatban.com:2053
trisis.fimsexnhatban.com:2083
trisis.fimsexnhatban.com:2087
trisis.fimsexnhatban.com:2096
trisis.fimsexnhatban.com:8443

Mutex

CiZqlRcNGhzQ

Attributes

delay
0
install
true
install_file
0u4plx.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  ca36f0e2f8c3e1a0d9e6d3056ee0d2533ae588081112f893f99df894296a312a
- Size 45KB
- SHA256 ca36f0e2f8c3e1a0d9e6d3056ee0d2533ae588081112f893f99df894296a312a
- MD5 4d097dbd98b9909fa394843d9c0bdf91
- SHA1 d177ba65bb28b80381680bd97bf771893d2dfacd
- SHA512 5ca93030939b01a3fe5bf4db1475ba39aa981e98a7696f88071c75c0ad884816ed99e3b4873eb8b7aecebe3f3762f1b57dbbcbdb7e0de876818ce378a6d0a8e8
- SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYCDEbHB0jrOPI/izjbBgX3i6So4oqrF4BDZ0x:8uuSpTgyf2qySf3/i3buXS6SodqJ+d0x
- TLSH
  T1802309003BE8C127F2BE4F78A9F26145467EF6633603E6491CC451DB5623FC69A426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2