asyncrat | 5cca46bceecf612263447e5d979711ad2289726407833e5eb0b20e926bfddd23

Sharing

Copy URL Twitter E-mail

General

Target
5cca46bceecf612263447e5d979711ad2289726407833e5eb0b20e926bfddd23
Size 45KB
Sample260804-lnyetack7z
SHA256 5cca46bceecf612263447e5d979711ad2289726407833e5eb0b20e926bfddd23
MD5 9a9c81ce84b12f2da0e77934da0e079b
SHA1 df60ec2e02c806075099954134dc8a9c3b357660
SHA512 be113f593e2f7daa78553870bb040afeb84a74db2338d2e8503e6c750576e0d9cf1ca2ef88a5e68681b561172cef1bef831466b0717329dfd376b905d7d32e28
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9q9YSkqXzNOPISzjbTgE3i4l34LS+DINcEBDZ8x:0uPrpT/qY2XaVq3S3bMES4lIvOd8x
TLSH
T185232A003BE8822BF2BE5FB899F26145867AF5733603D6491CC411975723FC68A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sextin.org:80
sextin.org:22
sextin.org:8080
sextin.org:8880
sextin.org:2052
sextin.org:2082
sextin.org:2086
sextin.org:2095
sextin.org:443
sextin.org:2053
sextin.org:2083
sextin.org:2087
sextin.org:2096
sextin.org:8443
www.sextin.org:80
www.sextin.org:22
www.sextin.org:8080
www.sextin.org:8880
www.sextin.org:2052
www.sextin.org:2082
www.sextin.org:2086
www.sextin.org:2095
www.sextin.org:443
www.sextin.org:2053
www.sextin.org:2083
www.sextin.org:2087
www.sextin.org:2096
www.sextin.org:8443
malware.sextin.org:80
malware.sextin.org:22
malware.sextin.org:8080
malware.sextin.org:8880
malware.sextin.org:2052
malware.sextin.org:2082
malware.sextin.org:2086
malware.sextin.org:2095
malware.sextin.org:443
malware.sextin.org:2053
malware.sextin.org:2083
malware.sextin.org:2087
malware.sextin.org:2096
malware.sextin.org:8443
agenttesla.sextin.org:80
agenttesla.sextin.org:22
agenttesla.sextin.org:8080
agenttesla.sextin.org:8880
agenttesla.sextin.org:2052
agenttesla.sextin.org:2082
agenttesla.sextin.org:2086
agenttesla.sextin.org:2095
agenttesla.sextin.org:443
agenttesla.sextin.org:2053
agenttesla.sextin.org:2083
agenttesla.sextin.org:2087
agenttesla.sextin.org:2096
agenttesla.sextin.org:8443
gootloader.sextin.org:80
gootloader.sextin.org:22
gootloader.sextin.org:8080
gootloader.sextin.org:8880
gootloader.sextin.org:2052
gootloader.sextin.org:2082
gootloader.sextin.org:2086
gootloader.sextin.org:2095
gootloader.sextin.org:443
gootloader.sextin.org:2053
gootloader.sextin.org:2083
gootloader.sextin.org:2087
gootloader.sextin.org:2096
gootloader.sextin.org:8443

Mutex

KHDQflKCkYkV

Attributes

delay
0
install
true
install_file
ihbfyoj.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5cca46bceecf612263447e5d979711ad2289726407833e5eb0b20e926bfddd23
- Size 45KB
- SHA256 5cca46bceecf612263447e5d979711ad2289726407833e5eb0b20e926bfddd23
- MD5 9a9c81ce84b12f2da0e77934da0e079b
- SHA1 df60ec2e02c806075099954134dc8a9c3b357660
- SHA512 be113f593e2f7daa78553870bb040afeb84a74db2338d2e8503e6c750576e0d9cf1ca2ef88a5e68681b561172cef1bef831466b0717329dfd376b905d7d32e28
- SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9q9YSkqXzNOPISzjbTgE3i4l34LS+DINcEBDZ8x:0uPrpT/qY2XaVq3S3bMES4lIvOd8x
- TLSH
  T185232A003BE8822BF2BE5FB899F26145867AF5733603D6491CC411975723FC68A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2