asyncrat | 4d41a99970a3f04df39cad0df912c3b57d57f0d7c9188843843c4f4fd7804d72

Sharing

Copy URL Twitter E-mail

General

Target
4d41a99970a3f04df39cad0df912c3b57d57f0d7c9188843843c4f4fd7804d72
Size 45KB
Sample260718-tntqmaft8k
SHA256 4d41a99970a3f04df39cad0df912c3b57d57f0d7c9188843843c4f4fd7804d72
MD5 9b01861d8a26fdb37c1a46af22b2d345
SHA1 a3018f3be6a0b800e3a241b132435899d7db4198
SHA512 6a44721ac10a68bd14692a6e654779f8de7f498e0a0f8838110f3d8a99ce6211fc2348e554335a8076834ea08271489478e8c71a618e2e573b04daceffb281a9
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA82q0CCMPd4CvS8PImGjb7gX3ikhpWQ72iIGEvPC/B8:kuSOpTPOP2MRCEWBmqbEXSkxyFpPWdMx
TLSH
T120232A0037E9812BF2BE4F7459F26245867AF1732603D58E1C8451DB5B23BC6DA42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsexto.blog:80
phimsexto.blog:22
phimsexto.blog:8080
phimsexto.blog:8880
phimsexto.blog:2052
phimsexto.blog:2082
phimsexto.blog:2086
phimsexto.blog:2095
phimsexto.blog:443
phimsexto.blog:2053
phimsexto.blog:2083
phimsexto.blog:2087
phimsexto.blog:2096
phimsexto.blog:8443
www.phimsexto.blog:80
www.phimsexto.blog:22
www.phimsexto.blog:8080
www.phimsexto.blog:8880
www.phimsexto.blog:2052
www.phimsexto.blog:2082
www.phimsexto.blog:2086
www.phimsexto.blog:2095
www.phimsexto.blog:443
www.phimsexto.blog:2053
www.phimsexto.blog:2083
www.phimsexto.blog:2087
www.phimsexto.blog:2096
www.phimsexto.blog:8443
zbot.phimsexto.blog:80
zbot.phimsexto.blog:22
zbot.phimsexto.blog:8080
zbot.phimsexto.blog:8880
zbot.phimsexto.blog:2052
zbot.phimsexto.blog:2082
zbot.phimsexto.blog:2086
zbot.phimsexto.blog:2095
zbot.phimsexto.blog:443
zbot.phimsexto.blog:2053
zbot.phimsexto.blog:2083
zbot.phimsexto.blog:2087
zbot.phimsexto.blog:2096
zbot.phimsexto.blog:8443
gh0st.phimsexto.blog:80
gh0st.phimsexto.blog:22
gh0st.phimsexto.blog:8080
gh0st.phimsexto.blog:8880
gh0st.phimsexto.blog:2052
gh0st.phimsexto.blog:2082
gh0st.phimsexto.blog:2086
gh0st.phimsexto.blog:2095
gh0st.phimsexto.blog:443
gh0st.phimsexto.blog:2053
gh0st.phimsexto.blog:2083
gh0st.phimsexto.blog:2087
gh0st.phimsexto.blog:2096
gh0st.phimsexto.blog:8443
hermeticwiper.phimsexto.blog:80
hermeticwiper.phimsexto.blog:22
hermeticwiper.phimsexto.blog:8080
hermeticwiper.phimsexto.blog:8880
hermeticwiper.phimsexto.blog:2052
hermeticwiper.phimsexto.blog:2082
hermeticwiper.phimsexto.blog:2086
hermeticwiper.phimsexto.blog:2095
hermeticwiper.phimsexto.blog:443
hermeticwiper.phimsexto.blog:2053
hermeticwiper.phimsexto.blog:2083
hermeticwiper.phimsexto.blog:2087
hermeticwiper.phimsexto.blog:2096
hermeticwiper.phimsexto.blog:8443
mydoom.phimsexto.blog:80
mydoom.phimsexto.blog:22
mydoom.phimsexto.blog:8080
mydoom.phimsexto.blog:8880
mydoom.phimsexto.blog:2052
mydoom.phimsexto.blog:2082
mydoom.phimsexto.blog:2086
mydoom.phimsexto.blog:2095
mydoom.phimsexto.blog:443
mydoom.phimsexto.blog:2053
mydoom.phimsexto.blog:2083
mydoom.phimsexto.blog:2087
mydoom.phimsexto.blog:2096
mydoom.phimsexto.blog:8443

Mutex

B6xZy0SuFosU

Attributes

delay
0
install
true
install_file
l9sc.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4d41a99970a3f04df39cad0df912c3b57d57f0d7c9188843843c4f4fd7804d72
- Size 45KB
- SHA256 4d41a99970a3f04df39cad0df912c3b57d57f0d7c9188843843c4f4fd7804d72
- MD5 9b01861d8a26fdb37c1a46af22b2d345
- SHA1 a3018f3be6a0b800e3a241b132435899d7db4198
- SHA512 6a44721ac10a68bd14692a6e654779f8de7f498e0a0f8838110f3d8a99ce6211fc2348e554335a8076834ea08271489478e8c71a618e2e573b04daceffb281a9
- SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA82q0CCMPd4CvS8PImGjb7gX3ikhpWQ72iIGEvPC/B8:kuSOpTPOP2MRCEWBmqbEXSkxyFpPWdMx
- TLSH
  T120232A0037E9812BF2BE4F7459F26245867AF1732603D58E1C8451DB5B23BC6DA42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2