asyncrat | 3ee6ab74484dc650b87fff3bca0b5145a7009e03fb75e8105e8e74e10f925517

Sharing

Copy URL Twitter E-mail

General

Target
3ee6ab74484dc650b87fff3bca0b5145a7009e03fb75e8105e8e74e10f925517
Size 45KB
Sample260802-y33djafc24
SHA256 3ee6ab74484dc650b87fff3bca0b5145a7009e03fb75e8105e8e74e10f925517
MD5 d088fc32c4ea8012b2f5bbae24883288
SHA1 cf73aab7e74e319d73d96ef24a074367fcecd3e5
SHA512 908f7bb4b59353460f45947b627bf8cc40af74c177d98ab511df238b183f8657ad5736639ebd5118e13665e4a8b4079aed4655129220189ac5a0f750c2206b1b
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA+VlcVc6GcPI+zjbSgX3+xg334LkNB9tnkRUBDZMx:kuSOpTPOP2OV226Gh+3bVXOxgY4Bfnkr
TLSH
T160232B0037E8C23BF2BE4FB899F26145867AF6633603D9491CC4519B5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimdugai.blog:80
phimdugai.blog:22
phimdugai.blog:8080
phimdugai.blog:8880
phimdugai.blog:2052
phimdugai.blog:2082
phimdugai.blog:2086
phimdugai.blog:2095
phimdugai.blog:443
phimdugai.blog:2053
phimdugai.blog:2083
phimdugai.blog:2087
phimdugai.blog:2096
phimdugai.blog:8443
www.phimdugai.blog:80
www.phimdugai.blog:22
www.phimdugai.blog:8080
www.phimdugai.blog:8880
www.phimdugai.blog:2052
www.phimdugai.blog:2082
www.phimdugai.blog:2086
www.phimdugai.blog:2095
www.phimdugai.blog:443
www.phimdugai.blog:2053
www.phimdugai.blog:2083
www.phimdugai.blog:2087
www.phimdugai.blog:2096
www.phimdugai.blog:8443
remcos.phimdugai.blog:80
remcos.phimdugai.blog:22
remcos.phimdugai.blog:8080
remcos.phimdugai.blog:8880
remcos.phimdugai.blog:2052
remcos.phimdugai.blog:2082
remcos.phimdugai.blog:2086
remcos.phimdugai.blog:2095
remcos.phimdugai.blog:443
remcos.phimdugai.blog:2053
remcos.phimdugai.blog:2083
remcos.phimdugai.blog:2087
remcos.phimdugai.blog:2096
remcos.phimdugai.blog:8443
hack.phimdugai.blog:80
hack.phimdugai.blog:22
hack.phimdugai.blog:8080
hack.phimdugai.blog:8880
hack.phimdugai.blog:2052
hack.phimdugai.blog:2082
hack.phimdugai.blog:2086
hack.phimdugai.blog:2095
hack.phimdugai.blog:443
hack.phimdugai.blog:2053
hack.phimdugai.blog:2083
hack.phimdugai.blog:2087
hack.phimdugai.blog:2096
hack.phimdugai.blog:8443
sasser.phimdugai.blog:80
sasser.phimdugai.blog:22
sasser.phimdugai.blog:8080
sasser.phimdugai.blog:8880
sasser.phimdugai.blog:2052
sasser.phimdugai.blog:2082
sasser.phimdugai.blog:2086
sasser.phimdugai.blog:2095
sasser.phimdugai.blog:443
sasser.phimdugai.blog:2053
sasser.phimdugai.blog:2083
sasser.phimdugai.blog:2087
sasser.phimdugai.blog:2096
sasser.phimdugai.blog:8443
remote.phimdugai.blog:80
remote.phimdugai.blog:22
remote.phimdugai.blog:8080
remote.phimdugai.blog:8880
remote.phimdugai.blog:2052
remote.phimdugai.blog:2082
remote.phimdugai.blog:2086
remote.phimdugai.blog:2095
remote.phimdugai.blog:443
remote.phimdugai.blog:2053
remote.phimdugai.blog:2083
remote.phimdugai.blog:2087
remote.phimdugai.blog:2096
remote.phimdugai.blog:8443

Mutex

K0AujflRcSfU

Attributes

delay
0
install
true
install_file
ypvs.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  3ee6ab74484dc650b87fff3bca0b5145a7009e03fb75e8105e8e74e10f925517
- Size 45KB
- SHA256 3ee6ab74484dc650b87fff3bca0b5145a7009e03fb75e8105e8e74e10f925517
- MD5 d088fc32c4ea8012b2f5bbae24883288
- SHA1 cf73aab7e74e319d73d96ef24a074367fcecd3e5
- SHA512 908f7bb4b59353460f45947b627bf8cc40af74c177d98ab511df238b183f8657ad5736639ebd5118e13665e4a8b4079aed4655129220189ac5a0f750c2206b1b
- SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA+VlcVc6GcPI+zjbSgX3+xg334LkNB9tnkRUBDZMx:kuSOpTPOP2OV226Gh+3bVXOxgY4Bfnkr
- TLSH
  T160232B0037E8C23BF2BE4FB899F26145867AF6633603D9491CC4519B5613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2