asyncrat | 48fda8134511153188f9989e3bf4cc891a416f5ea0eb1845acee3a46c18c4a4f

Sharing

Copy URL Twitter E-mail

General

Target
48fda8134511153188f9989e3bf4cc891a416f5ea0eb1845acee3a46c18c4a4f
Size 45KB
Sample260718-rjm16sds5m
SHA256 48fda8134511153188f9989e3bf4cc891a416f5ea0eb1845acee3a46c18c4a4f
MD5 455328b069cfb9fe80c88c95116b6581
SHA1 636624e773a7261e7c98d80d3056df556c04e336
SHA512 5bc85a8ea9e49cb8ea2bb6fed80ec1df3bbd7e1a41d66befd17e02d42dc16a693440f329826f5507a815d52d01a0b199f62004f2342b6a35067f73e5e337d588
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7EZbtDMkPIP9jbUgX3i9OGtwwd26yu/+r0Zz9BDZ+:0ushJTDXgH2nJQPVb7XSsGt/dIu/+r84
TLSH
T17A232A0037E8812BF2BE4F78ADF26145867AF2633603D5491CC451DB5623FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsexhayovh.com:80
phimsexhayovh.com:22
phimsexhayovh.com:8080
phimsexhayovh.com:8880
phimsexhayovh.com:2052
phimsexhayovh.com:2082
phimsexhayovh.com:2086
phimsexhayovh.com:2095
phimsexhayovh.com:443
phimsexhayovh.com:2053
phimsexhayovh.com:2083
phimsexhayovh.com:2087
phimsexhayovh.com:2096
phimsexhayovh.com:8443
www.phimsexhayovh.com:80
www.phimsexhayovh.com:22
www.phimsexhayovh.com:8080
www.phimsexhayovh.com:8880
www.phimsexhayovh.com:2052
www.phimsexhayovh.com:2082
www.phimsexhayovh.com:2086
www.phimsexhayovh.com:2095
www.phimsexhayovh.com:443
www.phimsexhayovh.com:2053
www.phimsexhayovh.com:2083
www.phimsexhayovh.com:2087
www.phimsexhayovh.com:2096
www.phimsexhayovh.com:8443
invasive.phimsexhayovh.com:80
invasive.phimsexhayovh.com:22
invasive.phimsexhayovh.com:8080
invasive.phimsexhayovh.com:8880
invasive.phimsexhayovh.com:2052
invasive.phimsexhayovh.com:2082
invasive.phimsexhayovh.com:2086
invasive.phimsexhayovh.com:2095
invasive.phimsexhayovh.com:443
invasive.phimsexhayovh.com:2053
invasive.phimsexhayovh.com:2083
invasive.phimsexhayovh.com:2087
invasive.phimsexhayovh.com:2096
invasive.phimsexhayovh.com:8443
shamoon.phimsexhayovh.com:80
shamoon.phimsexhayovh.com:22
shamoon.phimsexhayovh.com:8080
shamoon.phimsexhayovh.com:8880
shamoon.phimsexhayovh.com:2052
shamoon.phimsexhayovh.com:2082
shamoon.phimsexhayovh.com:2086
shamoon.phimsexhayovh.com:2095
shamoon.phimsexhayovh.com:443
shamoon.phimsexhayovh.com:2053
shamoon.phimsexhayovh.com:2083
shamoon.phimsexhayovh.com:2087
shamoon.phimsexhayovh.com:2096
shamoon.phimsexhayovh.com:8443
hack.phimsexhayovh.com:80
hack.phimsexhayovh.com:22
hack.phimsexhayovh.com:8080
hack.phimsexhayovh.com:8880
hack.phimsexhayovh.com:2052
hack.phimsexhayovh.com:2082
hack.phimsexhayovh.com:2086
hack.phimsexhayovh.com:2095
hack.phimsexhayovh.com:443
hack.phimsexhayovh.com:2053
hack.phimsexhayovh.com:2083
hack.phimsexhayovh.com:2087
hack.phimsexhayovh.com:2096
hack.phimsexhayovh.com:8443
clop.phimsexhayovh.com:80
clop.phimsexhayovh.com:22
clop.phimsexhayovh.com:8080
clop.phimsexhayovh.com:8880
clop.phimsexhayovh.com:2052
clop.phimsexhayovh.com:2082
clop.phimsexhayovh.com:2086
clop.phimsexhayovh.com:2095
clop.phimsexhayovh.com:443
clop.phimsexhayovh.com:2053
clop.phimsexhayovh.com:2083
clop.phimsexhayovh.com:2087
clop.phimsexhayovh.com:2096
clop.phimsexhayovh.com:8443

Mutex

4rOmrAFEc3wM

Attributes

delay
0
install
true
install_file
kmklde.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  48fda8134511153188f9989e3bf4cc891a416f5ea0eb1845acee3a46c18c4a4f
- Size 45KB
- SHA256 48fda8134511153188f9989e3bf4cc891a416f5ea0eb1845acee3a46c18c4a4f
- MD5 455328b069cfb9fe80c88c95116b6581
- SHA1 636624e773a7261e7c98d80d3056df556c04e336
- SHA512 5bc85a8ea9e49cb8ea2bb6fed80ec1df3bbd7e1a41d66befd17e02d42dc16a693440f329826f5507a815d52d01a0b199f62004f2342b6a35067f73e5e337d588
- SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7EZbtDMkPIP9jbUgX3i9OGtwwd26yu/+r0Zz9BDZ+:0ushJTDXgH2nJQPVb7XSsGt/dIu/+r84
- TLSH
  T17A232A0037E8812BF2BE4F78ADF26145867AF2633603D5491CC451DB5623FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2