asyncrat | b308db403b77bca6e048d5a1092604f52ad053d7530fefb4e3807338c5031eac

Sharing

Copy URL Twitter E-mail

General

Target
b308db403b77bca6e048d5a1092604f52ad053d7530fefb4e3807338c5031eac
Size 45KB
Sample260805-mx9d4swapc
SHA256 b308db403b77bca6e048d5a1092604f52ad053d7530fefb4e3807338c5031eac
MD5 acf8cdd8e5d5904486d6bb640660c42e
SHA1 dd99fa63f22bf2fc856a8c100dfbbf83e29c3c52
SHA512 39247a23da3d7aacf5c3f049bc5103f71365818126cd872641e90a5d1347ceddbe7094d57faf3bdbf8174cead608a9bd3c1140eae3e09ed4250093b3adfec5ab
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCMhdjCvS8PIj9jbAgX3ivqGh7MbAgC1i06tl:MuBGJTPho2Q/CChBjVbnXSZ7PgxrGjdG
TLSH
T1A4231A0037E9812BF6BE4B7869F26145867BF6733603D64A1C8441DB5613FC68A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

pod8ca.top:80
pod8ca.top:22
pod8ca.top:8080
pod8ca.top:8880
pod8ca.top:2052
pod8ca.top:2082
pod8ca.top:2086
pod8ca.top:2095
pod8ca.top:443
pod8ca.top:2053
pod8ca.top:2083
pod8ca.top:2087
pod8ca.top:2096
pod8ca.top:8443
www.pod8ca.top:80
www.pod8ca.top:22
www.pod8ca.top:8080
www.pod8ca.top:8880
www.pod8ca.top:2052
www.pod8ca.top:2082
www.pod8ca.top:2086
www.pod8ca.top:2095
www.pod8ca.top:443
www.pod8ca.top:2053
www.pod8ca.top:2083
www.pod8ca.top:2087
www.pod8ca.top:2096
www.pod8ca.top:8443
sodinokibi.pod8ca.top:80
sodinokibi.pod8ca.top:22
sodinokibi.pod8ca.top:8080
sodinokibi.pod8ca.top:8880
sodinokibi.pod8ca.top:2052
sodinokibi.pod8ca.top:2082
sodinokibi.pod8ca.top:2086
sodinokibi.pod8ca.top:2095
sodinokibi.pod8ca.top:443
sodinokibi.pod8ca.top:2053
sodinokibi.pod8ca.top:2083
sodinokibi.pod8ca.top:2087
sodinokibi.pod8ca.top:2096
sodinokibi.pod8ca.top:8443
locky.pod8ca.top:80
locky.pod8ca.top:22
locky.pod8ca.top:8080
locky.pod8ca.top:8880
locky.pod8ca.top:2052
locky.pod8ca.top:2082
locky.pod8ca.top:2086
locky.pod8ca.top:2095
locky.pod8ca.top:443
locky.pod8ca.top:2053
locky.pod8ca.top:2083
locky.pod8ca.top:2087
locky.pod8ca.top:2096
locky.pod8ca.top:8443
downadup.pod8ca.top:80
downadup.pod8ca.top:22
downadup.pod8ca.top:8080
downadup.pod8ca.top:8880
downadup.pod8ca.top:2052
downadup.pod8ca.top:2082
downadup.pod8ca.top:2086
downadup.pod8ca.top:2095
downadup.pod8ca.top:443
downadup.pod8ca.top:2053
downadup.pod8ca.top:2083
downadup.pod8ca.top:2087
downadup.pod8ca.top:2096
downadup.pod8ca.top:8443
malware.pod8ca.top:80
malware.pod8ca.top:22
malware.pod8ca.top:8080
malware.pod8ca.top:8880
malware.pod8ca.top:2052
malware.pod8ca.top:2082
malware.pod8ca.top:2086
malware.pod8ca.top:2095
malware.pod8ca.top:443
malware.pod8ca.top:2053
malware.pod8ca.top:2083
malware.pod8ca.top:2087
malware.pod8ca.top:2096
malware.pod8ca.top:8443

Mutex

HLr6wstn48v1

Attributes

delay
0
install
true
install_file
595a.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b308db403b77bca6e048d5a1092604f52ad053d7530fefb4e3807338c5031eac
- Size 45KB
- SHA256 b308db403b77bca6e048d5a1092604f52ad053d7530fefb4e3807338c5031eac
- MD5 acf8cdd8e5d5904486d6bb640660c42e
- SHA1 dd99fa63f22bf2fc856a8c100dfbbf83e29c3c52
- SHA512 39247a23da3d7aacf5c3f049bc5103f71365818126cd872641e90a5d1347ceddbe7094d57faf3bdbf8174cead608a9bd3c1140eae3e09ed4250093b3adfec5ab
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCMhdjCvS8PIj9jbAgX3ivqGh7MbAgC1i06tl:MuBGJTPho2Q/CChBjVbnXSZ7PgxrGjdG
- TLSH
  T1A4231A0037E9812BF6BE4B7869F26145867BF6733603D64A1C8441DB5613FC68A43AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2