asyncrat | fb448166902912a60a56a329906204eaabb544db4f1058c76bedd649e0a41eee

Sharing

Copy URL Twitter E-mail

General

Target
fb448166902912a60a56a329906204eaabb544db4f1058c76bedd649e0a41eee
Size 45KB
Sample260804-wajplstwd1
SHA256 fb448166902912a60a56a329906204eaabb544db4f1058c76bedd649e0a41eee
MD5 fead8c274020855c19fc750664e90ff5
SHA1 96e7c1d8e1b939b9d00face1245cb5eaa462410d
SHA512 d6a1f4506504ea7fb435b677d5a480720266eabe1df61b646364d04cf3b49058d8b0651d9d3494b3ef8ebaf1aa1ac81ed12f0ea36a16a60bdb3afcdd7bac9bf9
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9IDEbHBOjTOPI/TzjbKgX3iWujFGqWV/FKndjtBDZ+:0u1YJTHcw2HyYf3/T3bdXSWu58VdMdjo
TLSH
T18F232B003BE9C12BF27E4F78A9F26145467AF6A33603E5492CC451D75713FC68A42AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sex18.me:80
sex18.me:22
sex18.me:8080
sex18.me:8880
sex18.me:2052
sex18.me:2082
sex18.me:2086
sex18.me:2095
sex18.me:443
sex18.me:2053
sex18.me:2083
sex18.me:2087
sex18.me:2096
sex18.me:8443
www.sex18.me:80
www.sex18.me:22
www.sex18.me:8080
www.sex18.me:8880
www.sex18.me:2052
www.sex18.me:2082
www.sex18.me:2086
www.sex18.me:2095
www.sex18.me:443
www.sex18.me:2053
www.sex18.me:2083
www.sex18.me:2087
www.sex18.me:2096
www.sex18.me:8443
malware.sex18.me:80
malware.sex18.me:22
malware.sex18.me:8080
malware.sex18.me:8880
malware.sex18.me:2052
malware.sex18.me:2082
malware.sex18.me:2086
malware.sex18.me:2095
malware.sex18.me:443
malware.sex18.me:2053
malware.sex18.me:2083
malware.sex18.me:2087
malware.sex18.me:2096
malware.sex18.me:8443
invasive.sex18.me:80
invasive.sex18.me:22
invasive.sex18.me:8080
invasive.sex18.me:8880
invasive.sex18.me:2052
invasive.sex18.me:2082
invasive.sex18.me:2086
invasive.sex18.me:2095
invasive.sex18.me:443
invasive.sex18.me:2053
invasive.sex18.me:2083
invasive.sex18.me:2087
invasive.sex18.me:2096
invasive.sex18.me:8443
wannacry.sex18.me:80
wannacry.sex18.me:22
wannacry.sex18.me:8080
wannacry.sex18.me:8880
wannacry.sex18.me:2052
wannacry.sex18.me:2082
wannacry.sex18.me:2086
wannacry.sex18.me:2095
wannacry.sex18.me:443
wannacry.sex18.me:2053
wannacry.sex18.me:2083
wannacry.sex18.me:2087
wannacry.sex18.me:2096
wannacry.sex18.me:8443
emotet.sex18.me:80
emotet.sex18.me:22
emotet.sex18.me:8080
emotet.sex18.me:8880
emotet.sex18.me:2052
emotet.sex18.me:2082
emotet.sex18.me:2086
emotet.sex18.me:2095
emotet.sex18.me:443
emotet.sex18.me:2053
emotet.sex18.me:2083
emotet.sex18.me:2087
emotet.sex18.me:2096
emotet.sex18.me:8443

Mutex

woks55R0S54I

Attributes

delay
0
install
true
install_file
lwjasw.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  fb448166902912a60a56a329906204eaabb544db4f1058c76bedd649e0a41eee
- Size 45KB
- SHA256 fb448166902912a60a56a329906204eaabb544db4f1058c76bedd649e0a41eee
- MD5 fead8c274020855c19fc750664e90ff5
- SHA1 96e7c1d8e1b939b9d00face1245cb5eaa462410d
- SHA512 d6a1f4506504ea7fb435b677d5a480720266eabe1df61b646364d04cf3b49058d8b0651d9d3494b3ef8ebaf1aa1ac81ed12f0ea36a16a60bdb3afcdd7bac9bf9
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9IDEbHBOjTOPI/TzjbKgX3iWujFGqWV/FKndjtBDZ+:0u1YJTHcw2HyYf3/T3bdXSWu58VdMdjo
- TLSH
  T18F232B003BE9C12BF27E4F78A9F26145467AF6A33603E5492CC451D75713FC68A42AEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2