asyncrat | 36ae60c60599022306eb50be02fbc24c32be634b20106234d2a9400ebfad6fcc

Sharing

Copy URL Twitter E-mail

General

Target
36ae60c60599022306eb50be02fbc24c32be634b20106234d2a9400ebfad6fcc
Size 45KB
Sample260803-xt8zaayzex
SHA256 36ae60c60599022306eb50be02fbc24c32be634b20106234d2a9400ebfad6fcc
MD5 fef2334a0022c2732b7897987423208e
SHA1 53085c3ffea07faa93e370c3a38db4671966b22f
SHA512 c2bcd66bcea5293e226e89c0386d1e926464a0882091fc10a5c334985d881ed71695806769a6095a05dbb18a69c34cd42db55583206b88a0ce8eec1e83c536dd
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7jZoyTM4PIXVjbMgX3i5JwUXKMOEz6SnuAxBprBD4:0ushJTDXgH26h0X9bDXS53XK4mAuAxB0
TLSH
T161231B0037E8C12BF2BE4F7898F26145867AF6673603D58E1CC451DB5B13BC69A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xcavengon.click:80
xcavengon.click:22
xcavengon.click:8080
xcavengon.click:8880
xcavengon.click:2052
xcavengon.click:2082
xcavengon.click:2086
xcavengon.click:2095
xcavengon.click:443
xcavengon.click:2053
xcavengon.click:2083
xcavengon.click:2087
xcavengon.click:2096
xcavengon.click:8443
www.xcavengon.click:80
www.xcavengon.click:22
www.xcavengon.click:8080
www.xcavengon.click:8880
www.xcavengon.click:2052
www.xcavengon.click:2082
www.xcavengon.click:2086
www.xcavengon.click:2095
www.xcavengon.click:443
www.xcavengon.click:2053
www.xcavengon.click:2083
www.xcavengon.click:2087
www.xcavengon.click:2096
www.xcavengon.click:8443
melissa.xcavengon.click:80
melissa.xcavengon.click:22
melissa.xcavengon.click:8080
melissa.xcavengon.click:8880
melissa.xcavengon.click:2052
melissa.xcavengon.click:2082
melissa.xcavengon.click:2086
melissa.xcavengon.click:2095
melissa.xcavengon.click:443
melissa.xcavengon.click:2053
melissa.xcavengon.click:2083
melissa.xcavengon.click:2087
melissa.xcavengon.click:2096
melissa.xcavengon.click:8443
azorult.xcavengon.click:80
azorult.xcavengon.click:22
azorult.xcavengon.click:8080
azorult.xcavengon.click:8880
azorult.xcavengon.click:2052
azorult.xcavengon.click:2082
azorult.xcavengon.click:2086
azorult.xcavengon.click:2095
azorult.xcavengon.click:443
azorult.xcavengon.click:2053
azorult.xcavengon.click:2083
azorult.xcavengon.click:2087
azorult.xcavengon.click:2096
azorult.xcavengon.click:8443
malware.xcavengon.click:80
malware.xcavengon.click:22
malware.xcavengon.click:8080
malware.xcavengon.click:8880
malware.xcavengon.click:2052
malware.xcavengon.click:2082
malware.xcavengon.click:2086
malware.xcavengon.click:2095
malware.xcavengon.click:443
malware.xcavengon.click:2053
malware.xcavengon.click:2083
malware.xcavengon.click:2087
malware.xcavengon.click:2096
malware.xcavengon.click:8443
hack.xcavengon.click:80
hack.xcavengon.click:22
hack.xcavengon.click:8080
hack.xcavengon.click:8880
hack.xcavengon.click:2052
hack.xcavengon.click:2082
hack.xcavengon.click:2086
hack.xcavengon.click:2095
hack.xcavengon.click:443
hack.xcavengon.click:2053
hack.xcavengon.click:2083
hack.xcavengon.click:2087
hack.xcavengon.click:2096
hack.xcavengon.click:8443

Mutex

VUybkgKseS9z

Attributes

delay
0
install
true
install_file
xa0g5a.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  36ae60c60599022306eb50be02fbc24c32be634b20106234d2a9400ebfad6fcc
- Size 45KB
- SHA256 36ae60c60599022306eb50be02fbc24c32be634b20106234d2a9400ebfad6fcc
- MD5 fef2334a0022c2732b7897987423208e
- SHA1 53085c3ffea07faa93e370c3a38db4671966b22f
- SHA512 c2bcd66bcea5293e226e89c0386d1e926464a0882091fc10a5c334985d881ed71695806769a6095a05dbb18a69c34cd42db55583206b88a0ce8eec1e83c536dd
- SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7jZoyTM4PIXVjbMgX3i5JwUXKMOEz6SnuAxBprBD4:0ushJTDXgH26h0X9bDXS53XK4mAuAxB0
- TLSH
  T161231B0037E8C12BF2BE4F7898F26145867AF6673603D58E1CC451DB5B13BC69A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2