asyncrat | 2c8e423b8283fcf2b340633ab57167524ec4d616c14e9c635e3c9caedc18d1ad

Sharing

Copy URL Twitter E-mail

General

Target
2c8e423b8283fcf2b340633ab57167524ec4d616c14e9c635e3c9caedc18d1ad
Size 45KB
Sample260801-wdx2eaed98
SHA256 2c8e423b8283fcf2b340633ab57167524ec4d616c14e9c635e3c9caedc18d1ad
MD5 991b903e3881e9b626b1a437171831da
SHA1 5234152467c187e0c75771dc8fb0561355a36644
SHA512 b02b9d1825e026c0475ba5b38e904ed229192192150ed7a78a28edab1dc71fd69460a969cd3d0f2d2b61146e6c3a6749a737aa571d46651a9c279c2e43bd3b7a
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9L583IkOPIdzjb+gx3iVRx0M9h0Qm+WCBDZsx:EulCJTHl42cAF3d3bBxSjx0YfXdsx
TLSH
T1D3232A003BE8813BF2BE4F7899F22145867AF6677603D54A1CC441DB5613FC6DA426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xcavengon.click:80
xcavengon.click:22
xcavengon.click:8080
xcavengon.click:8880
xcavengon.click:2052
xcavengon.click:2082
xcavengon.click:2086
xcavengon.click:2095
xcavengon.click:443
xcavengon.click:2053
xcavengon.click:2083
xcavengon.click:2087
xcavengon.click:2096
xcavengon.click:8443
www.xcavengon.click:80
www.xcavengon.click:22
www.xcavengon.click:8080
www.xcavengon.click:8880
www.xcavengon.click:2052
www.xcavengon.click:2082
www.xcavengon.click:2086
www.xcavengon.click:2095
www.xcavengon.click:443
www.xcavengon.click:2053
www.xcavengon.click:2083
www.xcavengon.click:2087
www.xcavengon.click:2096
www.xcavengon.click:8443
locky.xcavengon.click:80
locky.xcavengon.click:22
locky.xcavengon.click:8080
locky.xcavengon.click:8880
locky.xcavengon.click:2052
locky.xcavengon.click:2082
locky.xcavengon.click:2086
locky.xcavengon.click:2095
locky.xcavengon.click:443
locky.xcavengon.click:2053
locky.xcavengon.click:2083
locky.xcavengon.click:2087
locky.xcavengon.click:2096
locky.xcavengon.click:8443
revil.xcavengon.click:80
revil.xcavengon.click:22
revil.xcavengon.click:8080
revil.xcavengon.click:8880
revil.xcavengon.click:2052
revil.xcavengon.click:2082
revil.xcavengon.click:2086
revil.xcavengon.click:2095
revil.xcavengon.click:443
revil.xcavengon.click:2053
revil.xcavengon.click:2083
revil.xcavengon.click:2087
revil.xcavengon.click:2096
revil.xcavengon.click:8443
mydoom.xcavengon.click:80
mydoom.xcavengon.click:22
mydoom.xcavengon.click:8080
mydoom.xcavengon.click:8880
mydoom.xcavengon.click:2052
mydoom.xcavengon.click:2082
mydoom.xcavengon.click:2086
mydoom.xcavengon.click:2095
mydoom.xcavengon.click:443
mydoom.xcavengon.click:2053
mydoom.xcavengon.click:2083
mydoom.xcavengon.click:2087
mydoom.xcavengon.click:2096
mydoom.xcavengon.click:8443

Mutex

qXIIKwIF3vqs

Attributes

delay
0
install
true
install_file
9192gl.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2c8e423b8283fcf2b340633ab57167524ec4d616c14e9c635e3c9caedc18d1ad
- Size 45KB
- SHA256 2c8e423b8283fcf2b340633ab57167524ec4d616c14e9c635e3c9caedc18d1ad
- MD5 991b903e3881e9b626b1a437171831da
- SHA1 5234152467c187e0c75771dc8fb0561355a36644
- SHA512 b02b9d1825e026c0475ba5b38e904ed229192192150ed7a78a28edab1dc71fd69460a969cd3d0f2d2b61146e6c3a6749a737aa571d46651a9c279c2e43bd3b7a
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9L583IkOPIdzjb+gx3iVRx0M9h0Qm+WCBDZsx:EulCJTHl42cAF3d3bBxSjx0YfXdsx
- TLSH
  T1D3232A003BE8813BF2BE4F7899F22145867AF6677603D54A1CC441DB5613FC6DA426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2