asyncrat | 8995b43eb50218fc40b5feee9555a49c9b963fa33190b578e5509b158362517d

Sharing

Copy URL Twitter E-mail

General

Target
8995b43eb50218fc40b5feee9555a49c9b963fa33190b578e5509b158362517d
Size 45KB
Sample260801-slwlrsce23
SHA256 8995b43eb50218fc40b5feee9555a49c9b963fa33190b578e5509b158362517d
MD5 2e35e4c87b2c788f65e9b5cc1349e2b7
SHA1 0fc34791b6a696599ed716837e7664d7cf76c239
SHA512 7eb802a2040cd0a7f340f881b6c61c909ce228a8823c894a24379271cc83116c2292f3e262903e754d85ee71be5e5d8293843feb4971129e74a6643277e431d4
SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qr5w0QbKXPI0zjb6gX3i18g2QvZcxhIf6RdwVBDZkx:vuogpT7I62Q803btXS18gABw7dkx
TLSH
T1D7232A003BE88127F2BE4F789CF26145467AF6633603D98D6CC451DB5623BC6DA426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xcavengon.click:80
xcavengon.click:22
xcavengon.click:8080
xcavengon.click:8880
xcavengon.click:2052
xcavengon.click:2082
xcavengon.click:2086
xcavengon.click:2095
xcavengon.click:443
xcavengon.click:2053
xcavengon.click:2083
xcavengon.click:2087
xcavengon.click:2096
xcavengon.click:8443
www.xcavengon.click:80
www.xcavengon.click:22
www.xcavengon.click:8080
www.xcavengon.click:8880
www.xcavengon.click:2052
www.xcavengon.click:2082
www.xcavengon.click:2086
www.xcavengon.click:2095
www.xcavengon.click:443
www.xcavengon.click:2053
www.xcavengon.click:2083
www.xcavengon.click:2087
www.xcavengon.click:2096
www.xcavengon.click:8443
dridex.xcavengon.click:80
dridex.xcavengon.click:22
dridex.xcavengon.click:8080
dridex.xcavengon.click:8880
dridex.xcavengon.click:2052
dridex.xcavengon.click:2082
dridex.xcavengon.click:2086
dridex.xcavengon.click:2095
dridex.xcavengon.click:443
dridex.xcavengon.click:2053
dridex.xcavengon.click:2083
dridex.xcavengon.click:2087
dridex.xcavengon.click:2096
dridex.xcavengon.click:8443
cl0p.xcavengon.click:80
cl0p.xcavengon.click:22
cl0p.xcavengon.click:8080
cl0p.xcavengon.click:8880
cl0p.xcavengon.click:2052
cl0p.xcavengon.click:2082
cl0p.xcavengon.click:2086
cl0p.xcavengon.click:2095
cl0p.xcavengon.click:443
cl0p.xcavengon.click:2053
cl0p.xcavengon.click:2083
cl0p.xcavengon.click:2087
cl0p.xcavengon.click:2096
cl0p.xcavengon.click:8443
trickbot.xcavengon.click:80
trickbot.xcavengon.click:22
trickbot.xcavengon.click:8080
trickbot.xcavengon.click:8880
trickbot.xcavengon.click:2052
trickbot.xcavengon.click:2082
trickbot.xcavengon.click:2086
trickbot.xcavengon.click:2095
trickbot.xcavengon.click:443
trickbot.xcavengon.click:2053
trickbot.xcavengon.click:2083
trickbot.xcavengon.click:2087
trickbot.xcavengon.click:2096
trickbot.xcavengon.click:8443
nanocore.xcavengon.click:80
nanocore.xcavengon.click:22
nanocore.xcavengon.click:8080
nanocore.xcavengon.click:8880
nanocore.xcavengon.click:2052
nanocore.xcavengon.click:2082
nanocore.xcavengon.click:2086
nanocore.xcavengon.click:2095
nanocore.xcavengon.click:443
nanocore.xcavengon.click:2053
nanocore.xcavengon.click:2083
nanocore.xcavengon.click:2087
nanocore.xcavengon.click:2096
nanocore.xcavengon.click:8443

Mutex

uVymx7DTkbcW

Attributes

delay
0
install
true
install_file
eh86xa33.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  8995b43eb50218fc40b5feee9555a49c9b963fa33190b578e5509b158362517d
- Size 45KB
- SHA256 8995b43eb50218fc40b5feee9555a49c9b963fa33190b578e5509b158362517d
- MD5 2e35e4c87b2c788f65e9b5cc1349e2b7
- SHA1 0fc34791b6a696599ed716837e7664d7cf76c239
- SHA512 7eb802a2040cd0a7f340f881b6c61c909ce228a8823c894a24379271cc83116c2292f3e262903e754d85ee71be5e5d8293843feb4971129e74a6643277e431d4
- SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qr5w0QbKXPI0zjb6gX3i18g2QvZcxhIf6RdwVBDZkx:vuogpT7I62Q803btXS18gABw7dkx
- TLSH
  T1D7232A003BE88127F2BE4F789CF26145467AF6633603D98D6CC451DB5623BC6DA426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2