asyncrat | af15ab2b7f00084dd1804a2e70e51bf6a31d720b113d48334e475a36884e04ae

Sharing

Copy URL Twitter E-mail

General

Target
af15ab2b7f00084dd1804a2e70e51bf6a31d720b113d48334e475a36884e04ae
Size 45KB
Sample260724-xbf6jsvwbw
SHA256 af15ab2b7f00084dd1804a2e70e51bf6a31d720b113d48334e475a36884e04ae
MD5 970eaa33049fe80bae43de6690091ccd
SHA1 c1e8f84133d31ad1ffc27be97f539501795c162c
SHA512 3bb69b7bba48b07db5b2df4a2ea0a6b0b3736a669d6f3947531279b04171487529cabdce2b67fd3e5ef117badff0826324ff1fd4bfb19278c815402b8259930f
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtDc30oiZPI/zjbwgX3ifalHZulnWUABDZEx:MuBGJTPho2twR2iW/3b3XSfwZulfWdEx
TLSH
T1F1233B0037E9C12BF2BF4B78A8F26145867AF6736603D5491CC451DB5623BC68A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsex321.net:80
phimsex321.net:22
phimsex321.net:8080
phimsex321.net:8880
phimsex321.net:2052
phimsex321.net:2082
phimsex321.net:2086
phimsex321.net:2095
phimsex321.net:443
phimsex321.net:2053
phimsex321.net:2083
phimsex321.net:2087
phimsex321.net:2096
phimsex321.net:8443
www.phimsex321.net:80
www.phimsex321.net:22
www.phimsex321.net:8080
www.phimsex321.net:8880
www.phimsex321.net:2052
www.phimsex321.net:2082
www.phimsex321.net:2086
www.phimsex321.net:2095
www.phimsex321.net:443
www.phimsex321.net:2053
www.phimsex321.net:2083
www.phimsex321.net:2087
www.phimsex321.net:2096
www.phimsex321.net:8443
gootloader.phimsex321.net:80
gootloader.phimsex321.net:22
gootloader.phimsex321.net:8080
gootloader.phimsex321.net:8880
gootloader.phimsex321.net:2052
gootloader.phimsex321.net:2082
gootloader.phimsex321.net:2086
gootloader.phimsex321.net:2095
gootloader.phimsex321.net:443
gootloader.phimsex321.net:2053
gootloader.phimsex321.net:2083
gootloader.phimsex321.net:2087
gootloader.phimsex321.net:2096
gootloader.phimsex321.net:8443
melissa.phimsex321.net:80
melissa.phimsex321.net:22
melissa.phimsex321.net:8080
melissa.phimsex321.net:8880
melissa.phimsex321.net:2052
melissa.phimsex321.net:2082
melissa.phimsex321.net:2086
melissa.phimsex321.net:2095
melissa.phimsex321.net:443
melissa.phimsex321.net:2053
melissa.phimsex321.net:2083
melissa.phimsex321.net:2087
melissa.phimsex321.net:2096
melissa.phimsex321.net:8443
connect.phimsex321.net:80
connect.phimsex321.net:22
connect.phimsex321.net:8080
connect.phimsex321.net:8880
connect.phimsex321.net:2052
connect.phimsex321.net:2082
connect.phimsex321.net:2086
connect.phimsex321.net:2095
connect.phimsex321.net:443
connect.phimsex321.net:2053
connect.phimsex321.net:2083
connect.phimsex321.net:2087
connect.phimsex321.net:2096
connect.phimsex321.net:8443

Mutex

GTCBHFQJxKwQ

Attributes

delay
0
install
true
install_file
vq4g.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  af15ab2b7f00084dd1804a2e70e51bf6a31d720b113d48334e475a36884e04ae
- Size 45KB
- SHA256 af15ab2b7f00084dd1804a2e70e51bf6a31d720b113d48334e475a36884e04ae
- MD5 970eaa33049fe80bae43de6690091ccd
- SHA1 c1e8f84133d31ad1ffc27be97f539501795c162c
- SHA512 3bb69b7bba48b07db5b2df4a2ea0a6b0b3736a669d6f3947531279b04171487529cabdce2b67fd3e5ef117badff0826324ff1fd4bfb19278c815402b8259930f
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe0ewtDc30oiZPI/zjbwgX3ifalHZulnWUABDZEx:MuBGJTPho2twR2iW/3b3XSfwZulfWdEx
- TLSH
  T1F1233B0037E9C12BF2BF4B78A8F26145867AF6736603D5491CC451DB5623BC68A43AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2