asyncrat | 316ae81890a48443be1242e2a7ded763cc11b980725e29ec50f90696dfcb1143

Sharing

Copy URL Twitter E-mail

General

Target
316ae81890a48443be1242e2a7ded763cc11b980725e29ec50f90696dfcb1143
Size 45KB
Sample260802-vxgyvstwfv
SHA256 316ae81890a48443be1242e2a7ded763cc11b980725e29ec50f90696dfcb1143
MD5 5dc650d60be44395473d8b5b53ad3a15
SHA1 74098a481e66d83a02f4634b44e8647f973b868d
SHA512 476f9c0cc709a7e0b532a037bb3b6b3f941d426b224a1819672e184447ec4da51dca2aee5fc9461d1ce5061077cea9b31761d4d0d21411641af41aaa53e6b95b
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q12FpPklON8APIDzjbRgX3iwWNDXu7ePKQLEFfyB0:cu6YepTPso2f7kwN8lD3beXSdZPKQwRH
TLSH
T1F52329003BE9813BF2BE5F78A8F26145467AF2637603D64D1CC452DB4623BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

podvid.top:80
podvid.top:22
podvid.top:8080
podvid.top:8880
podvid.top:2052
podvid.top:2082
podvid.top:2086
podvid.top:2095
podvid.top:443
podvid.top:2053
podvid.top:2083
podvid.top:2087
podvid.top:2096
podvid.top:8443
www.podvid.top:80
www.podvid.top:22
www.podvid.top:8080
www.podvid.top:8880
www.podvid.top:2052
www.podvid.top:2082
www.podvid.top:2086
www.podvid.top:2095
www.podvid.top:443
www.podvid.top:2053
www.podvid.top:2083
www.podvid.top:2087
www.podvid.top:2096
www.podvid.top:8443
zeus.podvid.top:80
zeus.podvid.top:22
zeus.podvid.top:8080
zeus.podvid.top:8880
zeus.podvid.top:2052
zeus.podvid.top:2082
zeus.podvid.top:2086
zeus.podvid.top:2095
zeus.podvid.top:443
zeus.podvid.top:2053
zeus.podvid.top:2083
zeus.podvid.top:2087
zeus.podvid.top:2096
zeus.podvid.top:8443
notpetya.podvid.top:80
notpetya.podvid.top:22
notpetya.podvid.top:8080
notpetya.podvid.top:8880
notpetya.podvid.top:2052
notpetya.podvid.top:2082
notpetya.podvid.top:2086
notpetya.podvid.top:2095
notpetya.podvid.top:443
notpetya.podvid.top:2053
notpetya.podvid.top:2083
notpetya.podvid.top:2087
notpetya.podvid.top:2096
notpetya.podvid.top:8443
downadup.podvid.top:80
downadup.podvid.top:22
downadup.podvid.top:8080
downadup.podvid.top:8880
downadup.podvid.top:2052
downadup.podvid.top:2082
downadup.podvid.top:2086
downadup.podvid.top:2095
downadup.podvid.top:443
downadup.podvid.top:2053
downadup.podvid.top:2083
downadup.podvid.top:2087
downadup.podvid.top:2096
downadup.podvid.top:8443
conficker.podvid.top:80
conficker.podvid.top:22
conficker.podvid.top:8080
conficker.podvid.top:8880
conficker.podvid.top:2052
conficker.podvid.top:2082
conficker.podvid.top:2086
conficker.podvid.top:2095
conficker.podvid.top:443
conficker.podvid.top:2053
conficker.podvid.top:2083
conficker.podvid.top:2087
conficker.podvid.top:2096
conficker.podvid.top:8443

Mutex

Hwk8fyKCIl5K

Attributes

delay
0
install
true
install_file
b8j418yy.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  316ae81890a48443be1242e2a7ded763cc11b980725e29ec50f90696dfcb1143
- Size 45KB
- SHA256 316ae81890a48443be1242e2a7ded763cc11b980725e29ec50f90696dfcb1143
- MD5 5dc650d60be44395473d8b5b53ad3a15
- SHA1 74098a481e66d83a02f4634b44e8647f973b868d
- SHA512 476f9c0cc709a7e0b532a037bb3b6b3f941d426b224a1819672e184447ec4da51dca2aee5fc9461d1ce5061077cea9b31761d4d0d21411641af41aaa53e6b95b
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q12FpPklON8APIDzjbRgX3iwWNDXu7ePKQLEFfyB0:cu6YepTPso2f7kwN8lD3beXSdZPKQwRH
- TLSH
  T1F52329003BE9813BF2BE5F78A8F26145467AF2637603D64D1CC452DB4623BC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2