asyncrat | 71837a96e37402aa82b8b2a4f3d1767e3eb89f08c875f8e462fef2f218144507

Sharing

Copy URL Twitter E-mail

General

Target
71837a96e37402aa82b8b2a4f3d1767e3eb89f08c875f8e462fef2f218144507
Size 45KB
Sample260803-vexatswtav
SHA256 71837a96e37402aa82b8b2a4f3d1767e3eb89f08c875f8e462fef2f218144507
MD5 40ebbdf5ee1ceb88c850e5ff17e0d41a
SHA1 40d20279959b02d1ddc2d0466f108b72229fa720
SHA512 33a021a4785a1a78658006d8dae7254dfa9737e57a04bf44f64a72a68d3edbc565dc86281c2b1b3276ee8cf4fb66c11d94eb68b0e9ce9ba5e3b6698108bedff0
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9UHO9YjoHPICYzjb5gX3iSraYvP4+leNBDZsx:EulCJTHl42A6kgCY3bWXSSFXzlWdsx
TLSH
T126232A103BE9C12BF2BE4F78A8F22145567AF6633603D58E1CC451DB5623FC68A426F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

podvid.top:80
podvid.top:22
podvid.top:8080
podvid.top:8880
podvid.top:2052
podvid.top:2082
podvid.top:2086
podvid.top:2095
podvid.top:443
podvid.top:2053
podvid.top:2083
podvid.top:2087
podvid.top:2096
podvid.top:8443
www.podvid.top:80
www.podvid.top:22
www.podvid.top:8080
www.podvid.top:8880
www.podvid.top:2052
www.podvid.top:2082
www.podvid.top:2086
www.podvid.top:2095
www.podvid.top:443
www.podvid.top:2053
www.podvid.top:2083
www.podvid.top:2087
www.podvid.top:2096
www.podvid.top:8443
codered.podvid.top:80
codered.podvid.top:22
codered.podvid.top:8080
codered.podvid.top:8880
codered.podvid.top:2052
codered.podvid.top:2082
codered.podvid.top:2086
codered.podvid.top:2095
codered.podvid.top:443
codered.podvid.top:2053
codered.podvid.top:2083
codered.podvid.top:2087
codered.podvid.top:2096
codered.podvid.top:8443
shamoon.podvid.top:80
shamoon.podvid.top:22
shamoon.podvid.top:8080
shamoon.podvid.top:8880
shamoon.podvid.top:2052
shamoon.podvid.top:2082
shamoon.podvid.top:2086
shamoon.podvid.top:2095
shamoon.podvid.top:443
shamoon.podvid.top:2053
shamoon.podvid.top:2083
shamoon.podvid.top:2087
shamoon.podvid.top:2096
shamoon.podvid.top:8443
connect.podvid.top:80
connect.podvid.top:22
connect.podvid.top:8080
connect.podvid.top:8880
connect.podvid.top:2052
connect.podvid.top:2082
connect.podvid.top:2086
connect.podvid.top:2095
connect.podvid.top:443
connect.podvid.top:2053
connect.podvid.top:2083
connect.podvid.top:2087
connect.podvid.top:2096
connect.podvid.top:8443
sodinokibi.podvid.top:80
sodinokibi.podvid.top:22
sodinokibi.podvid.top:8080
sodinokibi.podvid.top:8880
sodinokibi.podvid.top:2052
sodinokibi.podvid.top:2082
sodinokibi.podvid.top:2086
sodinokibi.podvid.top:2095
sodinokibi.podvid.top:443
sodinokibi.podvid.top:2053
sodinokibi.podvid.top:2083
sodinokibi.podvid.top:2087
sodinokibi.podvid.top:2096
sodinokibi.podvid.top:8443

Mutex

Qq53lFP1c6dW

Attributes

delay
0
install
true
install_file
zupt8z.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  71837a96e37402aa82b8b2a4f3d1767e3eb89f08c875f8e462fef2f218144507
- Size 45KB
- SHA256 71837a96e37402aa82b8b2a4f3d1767e3eb89f08c875f8e462fef2f218144507
- MD5 40ebbdf5ee1ceb88c850e5ff17e0d41a
- SHA1 40d20279959b02d1ddc2d0466f108b72229fa720
- SHA512 33a021a4785a1a78658006d8dae7254dfa9737e57a04bf44f64a72a68d3edbc565dc86281c2b1b3276ee8cf4fb66c11d94eb68b0e9ce9ba5e3b6698108bedff0
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9UHO9YjoHPICYzjb5gX3iSraYvP4+leNBDZsx:EulCJTHl42A6kgCY3bWXSSFXzlWdsx
- TLSH
  T126232A103BE9C12BF2BE4F78A8F22145567AF6633603D58E1CC451DB5623FC68A426F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2