asyncrat | e998c348a1e7b2f90aa1d3fdd68ffd61b2409563686a02e920edf987d3c746a0

Sharing

Copy URL Twitter E-mail

General

Target
e998c348a1e7b2f90aa1d3fdd68ffd61b2409563686a02e920edf987d3c746a0
Size 45KB
Sample260720-xa85yabz4m
SHA256 e998c348a1e7b2f90aa1d3fdd68ffd61b2409563686a02e920edf987d3c746a0
MD5 b6342b08a61c777284e43e067edb4e58
SHA1 9bb6dc296ad82f64648636e48bea111778b4a6e1
SHA512 846e9012df41dfdbf2735fb72e8fcb18b6ea3f064f816f95865c2d100e0ca7e4fa81973fca13395f19fdea31b4ce94af9f80ec0fe2e88468526db0c9d1bcafe7
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0yFjrdj3kk8PIhnjbOgX3iw39WDqiAi3BBDZG:MuBGJTPho2/LBXDBhjbxXSw3ADL/dEx
TLSH
T15F232B0037E9C12BF6BE4F7499F26245867AF5637603D64E1C8441CB5A23FC68A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsexvietnamhd.net:80
phimsexvietnamhd.net:22
phimsexvietnamhd.net:8080
phimsexvietnamhd.net:8880
phimsexvietnamhd.net:2052
phimsexvietnamhd.net:2082
phimsexvietnamhd.net:2086
phimsexvietnamhd.net:2095
phimsexvietnamhd.net:443
phimsexvietnamhd.net:2053
phimsexvietnamhd.net:2083
phimsexvietnamhd.net:2087
phimsexvietnamhd.net:2096
phimsexvietnamhd.net:8443
www.phimsexvietnamhd.net:80
www.phimsexvietnamhd.net:22
www.phimsexvietnamhd.net:8080
www.phimsexvietnamhd.net:8880
www.phimsexvietnamhd.net:2052
www.phimsexvietnamhd.net:2082
www.phimsexvietnamhd.net:2086
www.phimsexvietnamhd.net:2095
www.phimsexvietnamhd.net:443
www.phimsexvietnamhd.net:2053
www.phimsexvietnamhd.net:2083
www.phimsexvietnamhd.net:2087
www.phimsexvietnamhd.net:2096
www.phimsexvietnamhd.net:8443
trisis.phimsexvietnamhd.net:80
trisis.phimsexvietnamhd.net:22
trisis.phimsexvietnamhd.net:8080
trisis.phimsexvietnamhd.net:8880
trisis.phimsexvietnamhd.net:2052
trisis.phimsexvietnamhd.net:2082
trisis.phimsexvietnamhd.net:2086
trisis.phimsexvietnamhd.net:2095
trisis.phimsexvietnamhd.net:443
trisis.phimsexvietnamhd.net:2053
trisis.phimsexvietnamhd.net:2083
trisis.phimsexvietnamhd.net:2087
trisis.phimsexvietnamhd.net:2096
trisis.phimsexvietnamhd.net:8443
rat.phimsexvietnamhd.net:80
rat.phimsexvietnamhd.net:22
rat.phimsexvietnamhd.net:8080
rat.phimsexvietnamhd.net:8880
rat.phimsexvietnamhd.net:2052
rat.phimsexvietnamhd.net:2082
rat.phimsexvietnamhd.net:2086
rat.phimsexvietnamhd.net:2095
rat.phimsexvietnamhd.net:443
rat.phimsexvietnamhd.net:2053
rat.phimsexvietnamhd.net:2083
rat.phimsexvietnamhd.net:2087
rat.phimsexvietnamhd.net:2096
rat.phimsexvietnamhd.net:8443

Mutex

nsLBZKijfMD9

Attributes

delay
0
install
true
install_file
ofs8.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  e998c348a1e7b2f90aa1d3fdd68ffd61b2409563686a02e920edf987d3c746a0
- Size 45KB
- SHA256 e998c348a1e7b2f90aa1d3fdd68ffd61b2409563686a02e920edf987d3c746a0
- MD5 b6342b08a61c777284e43e067edb4e58
- SHA1 9bb6dc296ad82f64648636e48bea111778b4a6e1
- SHA512 846e9012df41dfdbf2735fb72e8fcb18b6ea3f064f816f95865c2d100e0ca7e4fa81973fca13395f19fdea31b4ce94af9f80ec0fe2e88468526db0c9d1bcafe7
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE0yFjrdj3kk8PIhnjbOgX3iw39WDqiAi3BBDZG:MuBGJTPho2/LBXDBhjbxXSw3ADL/dEx
- TLSH
  T15F232B0037E9C12BF6BE4F7499F26245867AF5637603D64E1C8441CB5A23FC68A42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2