asyncrat | 5907397b6b4bdd8ef453b1fc97294166b188ce65309498cd9ec289a5faf5d2fc

Sharing

Copy URL Twitter E-mail

General

Target
5907397b6b4bdd8ef453b1fc97294166b188ce65309498cd9ec289a5faf5d2fc
Size 45KB
Sample260802-tl9ztsstfs
SHA256 5907397b6b4bdd8ef453b1fc97294166b188ce65309498cd9ec289a5faf5d2fc
MD5 3e1e39e733498e08d5c6b7f1fa931319
SHA1 9771e577db790c01dcb4a26816bfcb0fe10a81e8
SHA512 0c0bdbfa29bbcf38d30068680ec0e02cbe644d31e81910013c543fcf27ee155d19a7dc017079edf99ae63adffab75dc6897668c1ef4ad3e4cf4bafc43a3174cc
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFa3xY6yZoOPI5zjb/gO3iBubl3SoChVHzSojBDZEx:MuLAZTnbg2vuPo353bIOSBGSRhVHOUdG
TLSH
T110231B003BE8812BF2BE4F78ADF26145467AF6732603D5891CC452DB5713FC69A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xcavengon.click:80
xcavengon.click:22
xcavengon.click:8080
xcavengon.click:8880
xcavengon.click:2052
xcavengon.click:2082
xcavengon.click:2086
xcavengon.click:2095
xcavengon.click:443
xcavengon.click:2053
xcavengon.click:2083
xcavengon.click:2087
xcavengon.click:2096
xcavengon.click:8443
www.xcavengon.click:80
www.xcavengon.click:22
www.xcavengon.click:8080
www.xcavengon.click:8880
www.xcavengon.click:2052
www.xcavengon.click:2082
www.xcavengon.click:2086
www.xcavengon.click:2095
www.xcavengon.click:443
www.xcavengon.click:2053
www.xcavengon.click:2083
www.xcavengon.click:2087
www.xcavengon.click:2096
www.xcavengon.click:8443
triton.xcavengon.click:80
triton.xcavengon.click:22
triton.xcavengon.click:8080
triton.xcavengon.click:8880
triton.xcavengon.click:2052
triton.xcavengon.click:2082
triton.xcavengon.click:2086
triton.xcavengon.click:2095
triton.xcavengon.click:443
triton.xcavengon.click:2053
triton.xcavengon.click:2083
triton.xcavengon.click:2087
triton.xcavengon.click:2096
triton.xcavengon.click:8443
zeus.xcavengon.click:80
zeus.xcavengon.click:22
zeus.xcavengon.click:8080
zeus.xcavengon.click:8880
zeus.xcavengon.click:2052
zeus.xcavengon.click:2082
zeus.xcavengon.click:2086
zeus.xcavengon.click:2095
zeus.xcavengon.click:443
zeus.xcavengon.click:2053
zeus.xcavengon.click:2083
zeus.xcavengon.click:2087
zeus.xcavengon.click:2096
zeus.xcavengon.click:8443
gootloader.xcavengon.click:80
gootloader.xcavengon.click:22
gootloader.xcavengon.click:8080
gootloader.xcavengon.click:8880
gootloader.xcavengon.click:2052
gootloader.xcavengon.click:2082
gootloader.xcavengon.click:2086
gootloader.xcavengon.click:2095
gootloader.xcavengon.click:443
gootloader.xcavengon.click:2053
gootloader.xcavengon.click:2083
gootloader.xcavengon.click:2087
gootloader.xcavengon.click:2096
gootloader.xcavengon.click:8443

Mutex

bdcz4ku4ycbj

Attributes

delay
0
install
true
install_file
2xdjk.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5907397b6b4bdd8ef453b1fc97294166b188ce65309498cd9ec289a5faf5d2fc
- Size 45KB
- SHA256 5907397b6b4bdd8ef453b1fc97294166b188ce65309498cd9ec289a5faf5d2fc
- MD5 3e1e39e733498e08d5c6b7f1fa931319
- SHA1 9771e577db790c01dcb4a26816bfcb0fe10a81e8
- SHA512 0c0bdbfa29bbcf38d30068680ec0e02cbe644d31e81910013c543fcf27ee155d19a7dc017079edf99ae63adffab75dc6897668c1ef4ad3e4cf4bafc43a3174cc
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFa3xY6yZoOPI5zjb/gO3iBubl3SoChVHzSojBDZEx:MuLAZTnbg2vuPo353bIOSBGSRhVHOUdG
- TLSH
  T110231B003BE8812BF2BE4F78ADF26145467AF6732603D5891CC452DB5713FC69A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2