asyncrat | 6365cfe002314132a0da32cedaba9434438d28a9f918e7064175b71172c12b49

Sharing

Copy URL Twitter E-mail

General

Target
6365cfe002314132a0da32cedaba9434438d28a9f918e7064175b71172c12b49
Size 45KB
Sample260801-v9w9basfjd
SHA256 6365cfe002314132a0da32cedaba9434438d28a9f918e7064175b71172c12b49
MD5 fd9a8505bc7b582ed0a4d5e9d4e7448e
SHA1 60e102d17ce07bc96bdd894227cf39713b9bd72d
SHA512 c3d4f0db4f5da329c45c6ebb06b21a3133ad0b46a9bec967a9732b1d6575c469544237dd0b5479a8b1db84cafea5b6894d49614035bbaa35ceec978fd1e14436
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjb2gX3iBAMvqHoG4BDZG:MuLAZTnbg2vSAvQZh6OAE3bpXSBHvqCE
TLSH
T190232A003BE8812BF2BF4FB899F26145867AF2633603D69A1CC451D75723BC69A425FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

podvid.top:80
podvid.top:22
podvid.top:8080
podvid.top:8880
podvid.top:2052
podvid.top:2082
podvid.top:2086
podvid.top:2095
podvid.top:443
podvid.top:2053
podvid.top:2083
podvid.top:2087
podvid.top:2096
podvid.top:8443
www.podvid.top:80
www.podvid.top:22
www.podvid.top:8080
www.podvid.top:8880
www.podvid.top:2052
www.podvid.top:2082
www.podvid.top:2086
www.podvid.top:2095
www.podvid.top:443
www.podvid.top:2053
www.podvid.top:2083
www.podvid.top:2087
www.podvid.top:2096
www.podvid.top:8443
blacklotus.podvid.top:80
blacklotus.podvid.top:22
blacklotus.podvid.top:8080
blacklotus.podvid.top:8880
blacklotus.podvid.top:2052
blacklotus.podvid.top:2082
blacklotus.podvid.top:2086
blacklotus.podvid.top:2095
blacklotus.podvid.top:443
blacklotus.podvid.top:2053
blacklotus.podvid.top:2083
blacklotus.podvid.top:2087
blacklotus.podvid.top:2096
blacklotus.podvid.top:8443
conficker.podvid.top:80
conficker.podvid.top:22
conficker.podvid.top:8080
conficker.podvid.top:8880
conficker.podvid.top:2052
conficker.podvid.top:2082
conficker.podvid.top:2086
conficker.podvid.top:2095
conficker.podvid.top:443
conficker.podvid.top:2053
conficker.podvid.top:2083
conficker.podvid.top:2087
conficker.podvid.top:2096
conficker.podvid.top:8443
wannacry.podvid.top:80
wannacry.podvid.top:22
wannacry.podvid.top:8080
wannacry.podvid.top:8880
wannacry.podvid.top:2052
wannacry.podvid.top:2082
wannacry.podvid.top:2086
wannacry.podvid.top:2095
wannacry.podvid.top:443
wannacry.podvid.top:2053
wannacry.podvid.top:2083
wannacry.podvid.top:2087
wannacry.podvid.top:2096
wannacry.podvid.top:8443
emotet.podvid.top:80
emotet.podvid.top:22
emotet.podvid.top:8080
emotet.podvid.top:8880
emotet.podvid.top:2052
emotet.podvid.top:2082
emotet.podvid.top:2086
emotet.podvid.top:2095
emotet.podvid.top:443
emotet.podvid.top:2053
emotet.podvid.top:2083
emotet.podvid.top:2087
emotet.podvid.top:2096
emotet.podvid.top:8443

Mutex

zUpAynpvW0wk

Attributes

delay
0
install
true
install_file
1m1iz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6365cfe002314132a0da32cedaba9434438d28a9f918e7064175b71172c12b49
- Size 45KB
- SHA256 6365cfe002314132a0da32cedaba9434438d28a9f918e7064175b71172c12b49
- MD5 fd9a8505bc7b582ed0a4d5e9d4e7448e
- SHA1 60e102d17ce07bc96bdd894227cf39713b9bd72d
- SHA512 c3d4f0db4f5da329c45c6ebb06b21a3133ad0b46a9bec967a9732b1d6575c469544237dd0b5479a8b1db84cafea5b6894d49614035bbaa35ceec978fd1e14436
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjb2gX3iBAMvqHoG4BDZG:MuLAZTnbg2vSAvQZh6OAE3bpXSBHvqCE
- TLSH
  T190232A003BE8812BF2BF4FB899F26145867AF2633603D69A1CC451D75723BC69A425FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2