asyncrat | 06feec8f81f456073b7ed822951a6b26349d69101d6aa22c953875f03689d4d7

Sharing

Copy URL Twitter E-mail

General

Target
06feec8f81f456073b7ed822951a6b26349d69101d6aa22c953875f03689d4d7
Size 45KB
Sample260801-t5kjaadf52
SHA256 06feec8f81f456073b7ed822951a6b26349d69101d6aa22c953875f03689d4d7
MD5 19c3acbdf619880f377508cd5800b376
SHA1 2e7da0a664c8cbaa5582bfeed1ed0d7b63def039
SHA512 d65afc100dd3f45f84c5b11b541c469963023fa063926a00ff1702bde5845fce1d85856365373cf6fb7c4001bef73ae58b3d45bda66df1cc47f4f68900f54ce8
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9xMcYssiJROPIcCzjbugXTiZboe4p9f/KDBDZsx:EulCJTHl42enl/3cC3bRXOl0JyFdsx
TLSH
T197232B003BE9822BF2BE4FB898F26145867AF5633603E58E1CC451D75613FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xcavengon.click:80
xcavengon.click:22
xcavengon.click:8080
xcavengon.click:8880
xcavengon.click:2052
xcavengon.click:2082
xcavengon.click:2086
xcavengon.click:2095
xcavengon.click:443
xcavengon.click:2053
xcavengon.click:2083
xcavengon.click:2087
xcavengon.click:2096
xcavengon.click:8443
www.xcavengon.click:80
www.xcavengon.click:22
www.xcavengon.click:8080
www.xcavengon.click:8880
www.xcavengon.click:2052
www.xcavengon.click:2082
www.xcavengon.click:2086
www.xcavengon.click:2095
www.xcavengon.click:443
www.xcavengon.click:2053
www.xcavengon.click:2083
www.xcavengon.click:2087
www.xcavengon.click:2096
www.xcavengon.click:8443
lokibot.xcavengon.click:80
lokibot.xcavengon.click:22
lokibot.xcavengon.click:8080
lokibot.xcavengon.click:8880
lokibot.xcavengon.click:2052
lokibot.xcavengon.click:2082
lokibot.xcavengon.click:2086
lokibot.xcavengon.click:2095
lokibot.xcavengon.click:443
lokibot.xcavengon.click:2053
lokibot.xcavengon.click:2083
lokibot.xcavengon.click:2087
lokibot.xcavengon.click:2096
lokibot.xcavengon.click:8443
remcos.xcavengon.click:80
remcos.xcavengon.click:22
remcos.xcavengon.click:8080
remcos.xcavengon.click:8880
remcos.xcavengon.click:2052
remcos.xcavengon.click:2082
remcos.xcavengon.click:2086
remcos.xcavengon.click:2095
remcos.xcavengon.click:443
remcos.xcavengon.click:2053
remcos.xcavengon.click:2083
remcos.xcavengon.click:2087
remcos.xcavengon.click:2096
remcos.xcavengon.click:8443
downadup.xcavengon.click:80
downadup.xcavengon.click:22
downadup.xcavengon.click:8080
downadup.xcavengon.click:8880
downadup.xcavengon.click:2052
downadup.xcavengon.click:2082
downadup.xcavengon.click:2086
downadup.xcavengon.click:2095
downadup.xcavengon.click:443
downadup.xcavengon.click:2053
downadup.xcavengon.click:2083
downadup.xcavengon.click:2087
downadup.xcavengon.click:2096
downadup.xcavengon.click:8443

Mutex

GxhIJw9N55xS

Attributes

delay
0
install
true
install_file
93x3er.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  06feec8f81f456073b7ed822951a6b26349d69101d6aa22c953875f03689d4d7
- Size 45KB
- SHA256 06feec8f81f456073b7ed822951a6b26349d69101d6aa22c953875f03689d4d7
- MD5 19c3acbdf619880f377508cd5800b376
- SHA1 2e7da0a664c8cbaa5582bfeed1ed0d7b63def039
- SHA512 d65afc100dd3f45f84c5b11b541c469963023fa063926a00ff1702bde5845fce1d85856365373cf6fb7c4001bef73ae58b3d45bda66df1cc47f4f68900f54ce8
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9xMcYssiJROPIcCzjbugXTiZboe4p9f/KDBDZsx:EulCJTHl42enl/3cC3bRXOl0JyFdsx
- TLSH
  T197232B003BE9822BF2BE4FB898F26145867AF5633603E58E1CC451D75613FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2