asyncrat | a4f1b6aeb4090a1c8d191372bc0d50ded276b8d3aa453c24a7221dd53927c5ee

Sharing

Copy URL Twitter E-mail

General

Target
a4f1b6aeb4090a1c8d191372bc0d50ded276b8d3aa453c24a7221dd53927c5ee
Size 45KB
Sample260720-vxgm4abs2x
SHA256 a4f1b6aeb4090a1c8d191372bc0d50ded276b8d3aa453c24a7221dd53927c5ee
MD5 bdfc789ef993112add2330d2b2c2779d
SHA1 23b45a47c43eaf5178bfcfedc9ffc297cd25ca4e
SHA512 449003077ed69401febf81c76fb29e7e0468363e012d11a1ad056b07240ca3b48710e8aa78a9e66d14b3c7572a154a3110b6a01c2688271698fd78083d636df9
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVPBjusyQowsPIWzjbvgX31vLf6n3RBDZEx:MuBGJTPho2WBjuxZwRW3bYXlvLCn3vdG
TLSH
T1EB23090037E8C12BF2BE4F7899F26146867AF6636603D54A1CC451DB5623FC6CA42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsexvietnamhd.net:80
phimsexvietnamhd.net:22
phimsexvietnamhd.net:8080
phimsexvietnamhd.net:8880
phimsexvietnamhd.net:2052
phimsexvietnamhd.net:2082
phimsexvietnamhd.net:2086
phimsexvietnamhd.net:2095
phimsexvietnamhd.net:443
phimsexvietnamhd.net:2053
phimsexvietnamhd.net:2083
phimsexvietnamhd.net:2087
phimsexvietnamhd.net:2096
phimsexvietnamhd.net:8443
www.phimsexvietnamhd.net:80
www.phimsexvietnamhd.net:22
www.phimsexvietnamhd.net:8080
www.phimsexvietnamhd.net:8880
www.phimsexvietnamhd.net:2052
www.phimsexvietnamhd.net:2082
www.phimsexvietnamhd.net:2086
www.phimsexvietnamhd.net:2095
www.phimsexvietnamhd.net:443
www.phimsexvietnamhd.net:2053
www.phimsexvietnamhd.net:2083
www.phimsexvietnamhd.net:2087
www.phimsexvietnamhd.net:2096
www.phimsexvietnamhd.net:8443
revil.phimsexvietnamhd.net:80
revil.phimsexvietnamhd.net:22
revil.phimsexvietnamhd.net:8080
revil.phimsexvietnamhd.net:8880
revil.phimsexvietnamhd.net:2052
revil.phimsexvietnamhd.net:2082
revil.phimsexvietnamhd.net:2086
revil.phimsexvietnamhd.net:2095
revil.phimsexvietnamhd.net:443
revil.phimsexvietnamhd.net:2053
revil.phimsexvietnamhd.net:2083
revil.phimsexvietnamhd.net:2087
revil.phimsexvietnamhd.net:2096
revil.phimsexvietnamhd.net:8443
notpetya.phimsexvietnamhd.net:80
notpetya.phimsexvietnamhd.net:22
notpetya.phimsexvietnamhd.net:8080
notpetya.phimsexvietnamhd.net:8880
notpetya.phimsexvietnamhd.net:2052
notpetya.phimsexvietnamhd.net:2082
notpetya.phimsexvietnamhd.net:2086
notpetya.phimsexvietnamhd.net:2095
notpetya.phimsexvietnamhd.net:443
notpetya.phimsexvietnamhd.net:2053
notpetya.phimsexvietnamhd.net:2083
notpetya.phimsexvietnamhd.net:2087
notpetya.phimsexvietnamhd.net:2096
notpetya.phimsexvietnamhd.net:8443

Mutex

U4FbPHrdgkoS

Attributes

delay
0
install
true
install_file
yk8s.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a4f1b6aeb4090a1c8d191372bc0d50ded276b8d3aa453c24a7221dd53927c5ee
- Size 45KB
- SHA256 a4f1b6aeb4090a1c8d191372bc0d50ded276b8d3aa453c24a7221dd53927c5ee
- MD5 bdfc789ef993112add2330d2b2c2779d
- SHA1 23b45a47c43eaf5178bfcfedc9ffc297cd25ca4e
- SHA512 449003077ed69401febf81c76fb29e7e0468363e012d11a1ad056b07240ca3b48710e8aa78a9e66d14b3c7572a154a3110b6a01c2688271698fd78083d636df9
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVPBjusyQowsPIWzjbvgX31vLf6n3RBDZEx:MuBGJTPho2WBjuxZwRW3bYXlvLCn3vdG
- TLSH
  T1EB23090037E8C12BF2BE4F7899F26146867AF6636603D54A1CC451DB5623FC6CA42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2