asyncrat | 2d4cc44153fe22f6723f4558c87a748ed0a6e5c05bce0735f6f44badb324112e

Sharing

Copy URL Twitter E-mail

General

Target
2d4cc44153fe22f6723f4558c87a748ed0a6e5c05bce0735f6f44badb324112e
Size 45KB
Sample260718-rssm1sgy9v
SHA256 2d4cc44153fe22f6723f4558c87a748ed0a6e5c05bce0735f6f44badb324112e
MD5 81d6cab0b2979da75fcf45d5cbf96b9f
SHA1 586ed26a62638aa0a17a7406598be9695a90915e
SHA512 c50adf647bbae122966fc8ff854f15391b5ba5d2d8d0c1804364b0405432d563a94704f6b48282a25f60640376bc0ece5b1f574fc13ad9e3c70ab79c786fa12f
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAT0b3NLAteiZPImzjbYgh3iK6Xp6dSKpv5hvELfZR:cuqNJTLr6263ZhiWm3bPhSK6XWSKpv58
TLSH
T1F8232A003BE9C12BF2BE4F74A9F25245867AF6633603D9491CC451D75623FC68A43AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zephimsexhay.com:80
zephimsexhay.com:22
zephimsexhay.com:8080
zephimsexhay.com:8880
zephimsexhay.com:2052
zephimsexhay.com:2082
zephimsexhay.com:2086
zephimsexhay.com:2095
zephimsexhay.com:443
zephimsexhay.com:2053
zephimsexhay.com:2083
zephimsexhay.com:2087
zephimsexhay.com:2096
zephimsexhay.com:8443
www.zephimsexhay.com:80
www.zephimsexhay.com:22
www.zephimsexhay.com:8080
www.zephimsexhay.com:8880
www.zephimsexhay.com:2052
www.zephimsexhay.com:2082
www.zephimsexhay.com:2086
www.zephimsexhay.com:2095
www.zephimsexhay.com:443
www.zephimsexhay.com:2053
www.zephimsexhay.com:2083
www.zephimsexhay.com:2087
www.zephimsexhay.com:2096
www.zephimsexhay.com:8443
connect.zephimsexhay.com:80
connect.zephimsexhay.com:22
connect.zephimsexhay.com:8080
connect.zephimsexhay.com:8880
connect.zephimsexhay.com:2052
connect.zephimsexhay.com:2082
connect.zephimsexhay.com:2086
connect.zephimsexhay.com:2095
connect.zephimsexhay.com:443
connect.zephimsexhay.com:2053
connect.zephimsexhay.com:2083
connect.zephimsexhay.com:2087
connect.zephimsexhay.com:2096
connect.zephimsexhay.com:8443
sasser.zephimsexhay.com:80
sasser.zephimsexhay.com:22
sasser.zephimsexhay.com:8080
sasser.zephimsexhay.com:8880
sasser.zephimsexhay.com:2052
sasser.zephimsexhay.com:2082
sasser.zephimsexhay.com:2086
sasser.zephimsexhay.com:2095
sasser.zephimsexhay.com:443
sasser.zephimsexhay.com:2053
sasser.zephimsexhay.com:2083
sasser.zephimsexhay.com:2087
sasser.zephimsexhay.com:2096
sasser.zephimsexhay.com:8443
blaster.zephimsexhay.com:80
blaster.zephimsexhay.com:22
blaster.zephimsexhay.com:8080
blaster.zephimsexhay.com:8880
blaster.zephimsexhay.com:2052
blaster.zephimsexhay.com:2082
blaster.zephimsexhay.com:2086
blaster.zephimsexhay.com:2095
blaster.zephimsexhay.com:443
blaster.zephimsexhay.com:2053
blaster.zephimsexhay.com:2083
blaster.zephimsexhay.com:2087
blaster.zephimsexhay.com:2096
blaster.zephimsexhay.com:8443
qbot.zephimsexhay.com:80
qbot.zephimsexhay.com:22
qbot.zephimsexhay.com:8080
qbot.zephimsexhay.com:8880
qbot.zephimsexhay.com:2052
qbot.zephimsexhay.com:2082
qbot.zephimsexhay.com:2086
qbot.zephimsexhay.com:2095
qbot.zephimsexhay.com:443
qbot.zephimsexhay.com:2053
qbot.zephimsexhay.com:2083
qbot.zephimsexhay.com:2087
qbot.zephimsexhay.com:2096
qbot.zephimsexhay.com:8443

Mutex

PflzEoY1yRVe

Attributes

delay
0
install
true
install_file
u4al.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2d4cc44153fe22f6723f4558c87a748ed0a6e5c05bce0735f6f44badb324112e
- Size 45KB
- SHA256 2d4cc44153fe22f6723f4558c87a748ed0a6e5c05bce0735f6f44badb324112e
- MD5 81d6cab0b2979da75fcf45d5cbf96b9f
- SHA1 586ed26a62638aa0a17a7406598be9695a90915e
- SHA512 c50adf647bbae122966fc8ff854f15391b5ba5d2d8d0c1804364b0405432d563a94704f6b48282a25f60640376bc0ece5b1f574fc13ad9e3c70ab79c786fa12f
- SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAT0b3NLAteiZPImzjbYgh3iK6Xp6dSKpv5hvELfZR:cuqNJTLr6263ZhiWm3bPhSK6XWSKpv58
- TLSH
  T1F8232A003BE9C12BF2BE4F74A9F25245867AF6633603D9491CC451D75623FC68A43AEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2