asyncrat | c9434aa411f7d4d2dd6f5deb32833548bc0031835afa7e6de05123d8bcce3a15

Sharing

Copy URL Twitter E-mail

General

Target
c9434aa411f7d4d2dd6f5deb32833548bc0031835afa7e6de05123d8bcce3a15
Size 45KB
Sample260801-v14a9seb99
SHA256 c9434aa411f7d4d2dd6f5deb32833548bc0031835afa7e6de05123d8bcce3a15
MD5 1114021ada162bee19d1c2821115bcbb
SHA1 c1f48d8c4b874b04af8ab6e4f1736480a6f860de
SHA512 18874ba4a0a3e67999cb5435de888b86174884d74ba1e8a3432390cf0fe3113a8de01253e1a7aa6930f32ed0a3c3c4b267094ef996dae91f8db48d0abbf93431
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9UHO9YjoHPICYzjb6gX3i0yTRYzlRMgD76FIBBDZsx:EulCJTHl42A6kgCY3btXS0eOzlz7tdsx
TLSH
T13B23F9003BE4C12BF2BE5FB898F26145867AF6633603D64E1CC451DB5613FC69A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimdugai.blog:80
phimdugai.blog:22
phimdugai.blog:8080
phimdugai.blog:8880
phimdugai.blog:2052
phimdugai.blog:2082
phimdugai.blog:2086
phimdugai.blog:2095
phimdugai.blog:443
phimdugai.blog:2053
phimdugai.blog:2083
phimdugai.blog:2087
phimdugai.blog:2096
phimdugai.blog:8443
www.phimdugai.blog:80
www.phimdugai.blog:22
www.phimdugai.blog:8080
www.phimdugai.blog:8880
www.phimdugai.blog:2052
www.phimdugai.blog:2082
www.phimdugai.blog:2086
www.phimdugai.blog:2095
www.phimdugai.blog:443
www.phimdugai.blog:2053
www.phimdugai.blog:2083
www.phimdugai.blog:2087
www.phimdugai.blog:2096
www.phimdugai.blog:8443
connect.phimdugai.blog:80
connect.phimdugai.blog:22
connect.phimdugai.blog:8080
connect.phimdugai.blog:8880
connect.phimdugai.blog:2052
connect.phimdugai.blog:2082
connect.phimdugai.blog:2086
connect.phimdugai.blog:2095
connect.phimdugai.blog:443
connect.phimdugai.blog:2053
connect.phimdugai.blog:2083
connect.phimdugai.blog:2087
connect.phimdugai.blog:2096
connect.phimdugai.blog:8443
darkside.phimdugai.blog:80
darkside.phimdugai.blog:22
darkside.phimdugai.blog:8080
darkside.phimdugai.blog:8880
darkside.phimdugai.blog:2052
darkside.phimdugai.blog:2082
darkside.phimdugai.blog:2086
darkside.phimdugai.blog:2095
darkside.phimdugai.blog:443
darkside.phimdugai.blog:2053
darkside.phimdugai.blog:2083
darkside.phimdugai.blog:2087
darkside.phimdugai.blog:2096
darkside.phimdugai.blog:8443
rat.phimdugai.blog:80
rat.phimdugai.blog:22
rat.phimdugai.blog:8080
rat.phimdugai.blog:8880
rat.phimdugai.blog:2052
rat.phimdugai.blog:2082
rat.phimdugai.blog:2086
rat.phimdugai.blog:2095
rat.phimdugai.blog:443
rat.phimdugai.blog:2053
rat.phimdugai.blog:2083
rat.phimdugai.blog:2087
rat.phimdugai.blog:2096
rat.phimdugai.blog:8443

Mutex

lfAcTLowPIET

Attributes

delay
0
install
true
install_file
2qa3uz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c9434aa411f7d4d2dd6f5deb32833548bc0031835afa7e6de05123d8bcce3a15
- Size 45KB
- SHA256 c9434aa411f7d4d2dd6f5deb32833548bc0031835afa7e6de05123d8bcce3a15
- MD5 1114021ada162bee19d1c2821115bcbb
- SHA1 c1f48d8c4b874b04af8ab6e4f1736480a6f860de
- SHA512 18874ba4a0a3e67999cb5435de888b86174884d74ba1e8a3432390cf0fe3113a8de01253e1a7aa6930f32ed0a3c3c4b267094ef996dae91f8db48d0abbf93431
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9UHO9YjoHPICYzjb6gX3i0yTRYzlRMgD76FIBBDZsx:EulCJTHl42A6kgCY3btXS0eOzlz7tdsx
- TLSH
  T13B23F9003BE4C12BF2BE5FB898F26145867AF6633603D64E1CC451DB5613FC69A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2