asyncrat | d3be8cc1716eb46bd1e4bb52058df36f0c68a3f4df51182400d53527c5e29cc6

Sharing

Copy URL Twitter E-mail

General

Target
d3be8cc1716eb46bd1e4bb52058df36f0c68a3f4df51182400d53527c5e29cc6
Size 45KB
Sample260802-ma61gagf24
SHA256 d3be8cc1716eb46bd1e4bb52058df36f0c68a3f4df51182400d53527c5e29cc6
MD5 b38f91ada7cab203406175f2098fb646
SHA1 f83453c5f56bd2736982543efeb4e23b02f4bb3c
SHA512 480804b852d61f772bafa13ab17089dad917ae0ff60de7d697803ef95f53bdbde5d5fa7f7e31b6d0924007e7042975ea28ebf36cf653d5e55072eb176010dc75
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIgzjbCgX3i5oZm4sYszaCqgBDZsx:EulCJTHl42MRvg3blXS5lNzaC7dsx
TLSH
T186231A103BE8C12BF2BE4F78A8F25145867AF5673603D58A2CC441DB5623FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

podvid.top:80
podvid.top:22
podvid.top:8080
podvid.top:8880
podvid.top:2052
podvid.top:2082
podvid.top:2086
podvid.top:2095
podvid.top:443
podvid.top:2053
podvid.top:2083
podvid.top:2087
podvid.top:2096
podvid.top:8443
www.podvid.top:80
www.podvid.top:22
www.podvid.top:8080
www.podvid.top:8880
www.podvid.top:2052
www.podvid.top:2082
www.podvid.top:2086
www.podvid.top:2095
www.podvid.top:443
www.podvid.top:2053
www.podvid.top:2083
www.podvid.top:2087
www.podvid.top:2096
www.podvid.top:8443
notpetya.podvid.top:80
notpetya.podvid.top:22
notpetya.podvid.top:8080
notpetya.podvid.top:8880
notpetya.podvid.top:2052
notpetya.podvid.top:2082
notpetya.podvid.top:2086
notpetya.podvid.top:2095
notpetya.podvid.top:443
notpetya.podvid.top:2053
notpetya.podvid.top:2083
notpetya.podvid.top:2087
notpetya.podvid.top:2096
notpetya.podvid.top:8443
socgholish.podvid.top:80
socgholish.podvid.top:22
socgholish.podvid.top:8080
socgholish.podvid.top:8880
socgholish.podvid.top:2052
socgholish.podvid.top:2082
socgholish.podvid.top:2086
socgholish.podvid.top:2095
socgholish.podvid.top:443
socgholish.podvid.top:2053
socgholish.podvid.top:2083
socgholish.podvid.top:2087
socgholish.podvid.top:2096
socgholish.podvid.top:8443
client.podvid.top:80
client.podvid.top:22
client.podvid.top:8080
client.podvid.top:8880
client.podvid.top:2052
client.podvid.top:2082
client.podvid.top:2086
client.podvid.top:2095
client.podvid.top:443
client.podvid.top:2053
client.podvid.top:2083
client.podvid.top:2087
client.podvid.top:2096
client.podvid.top:8443
ryuk.podvid.top:80
ryuk.podvid.top:22
ryuk.podvid.top:8080
ryuk.podvid.top:8880
ryuk.podvid.top:2052
ryuk.podvid.top:2082
ryuk.podvid.top:2086
ryuk.podvid.top:2095
ryuk.podvid.top:443
ryuk.podvid.top:2053
ryuk.podvid.top:2083
ryuk.podvid.top:2087
ryuk.podvid.top:2096
ryuk.podvid.top:8443

Mutex

TgMlWaKDnXjH

Attributes

delay
0
install
true
install_file
hzpag4.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  d3be8cc1716eb46bd1e4bb52058df36f0c68a3f4df51182400d53527c5e29cc6
- Size 45KB
- SHA256 d3be8cc1716eb46bd1e4bb52058df36f0c68a3f4df51182400d53527c5e29cc6
- MD5 b38f91ada7cab203406175f2098fb646
- SHA1 f83453c5f56bd2736982543efeb4e23b02f4bb3c
- SHA512 480804b852d61f772bafa13ab17089dad917ae0ff60de7d697803ef95f53bdbde5d5fa7f7e31b6d0924007e7042975ea28ebf36cf653d5e55072eb176010dc75
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIgzjbCgX3i5oZm4sYszaCqgBDZsx:EulCJTHl42MRvg3blXS5lNzaC7dsx
- TLSH
  T186231A103BE8C12BF2BE4F78A8F25145867AF5673603D58A2CC441DB5623FC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2