asyncrat | 6eb2354dfde5f22a8296e76b39a4df36982f7b0d6a0308965c81c0067d5a4c43

Sharing

Copy URL Twitter E-mail

General

Target
6eb2354dfde5f22a8296e76b39a4df36982f7b0d6a0308965c81c0067d5a4c43
Size 45KB
Sample260805-pdvsqaxarb
SHA256 6eb2354dfde5f22a8296e76b39a4df36982f7b0d6a0308965c81c0067d5a4c43
MD5 d959331882be4ac3d953198d71d7005e
SHA1 09a5f9c2a4b3421e2f6adad3e1fb2d12a1a45ccf
SHA512 bb8b31367b75cbcbffb26b01f223f4e722ac3571ac4a77bfc497a6c0e92539af43e2d8edf2f2ba9e24c2342f419c8e9bea7a1c8e4b54ae11da93c3b8c38ffe66
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ICXtTtSPI/zjb7gX3iT4hH3U9nqwPF4DsAXBDZsx:EulCJTHl42fwx/3bEXSTkknLN4fdsx
TLSH
T1AA231B0037E9C13BF2BE4F78A9F26145867AF6633603E58D1CC4419B5623BC59A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexybeam.me:80
sexybeam.me:22
sexybeam.me:8080
sexybeam.me:8880
sexybeam.me:2052
sexybeam.me:2082
sexybeam.me:2086
sexybeam.me:2095
sexybeam.me:443
sexybeam.me:2053
sexybeam.me:2083
sexybeam.me:2087
sexybeam.me:2096
sexybeam.me:8443
www.sexybeam.me:80
www.sexybeam.me:22
www.sexybeam.me:8080
www.sexybeam.me:8880
www.sexybeam.me:2052
www.sexybeam.me:2082
www.sexybeam.me:2086
www.sexybeam.me:2095
www.sexybeam.me:443
www.sexybeam.me:2053
www.sexybeam.me:2083
www.sexybeam.me:2087
www.sexybeam.me:2096
www.sexybeam.me:8443
malware.sexybeam.me:80
malware.sexybeam.me:22
malware.sexybeam.me:8080
malware.sexybeam.me:8880
malware.sexybeam.me:2052
malware.sexybeam.me:2082
malware.sexybeam.me:2086
malware.sexybeam.me:2095
malware.sexybeam.me:443
malware.sexybeam.me:2053
malware.sexybeam.me:2083
malware.sexybeam.me:2087
malware.sexybeam.me:2096
malware.sexybeam.me:8443
lokibot.sexybeam.me:80
lokibot.sexybeam.me:22
lokibot.sexybeam.me:8080
lokibot.sexybeam.me:8880
lokibot.sexybeam.me:2052
lokibot.sexybeam.me:2082
lokibot.sexybeam.me:2086
lokibot.sexybeam.me:2095
lokibot.sexybeam.me:443
lokibot.sexybeam.me:2053
lokibot.sexybeam.me:2083
lokibot.sexybeam.me:2087
lokibot.sexybeam.me:2096
lokibot.sexybeam.me:8443
mirai.sexybeam.me:80
mirai.sexybeam.me:22
mirai.sexybeam.me:8080
mirai.sexybeam.me:8880
mirai.sexybeam.me:2052
mirai.sexybeam.me:2082
mirai.sexybeam.me:2086
mirai.sexybeam.me:2095
mirai.sexybeam.me:443
mirai.sexybeam.me:2053
mirai.sexybeam.me:2083
mirai.sexybeam.me:2087
mirai.sexybeam.me:2096
mirai.sexybeam.me:8443
zbot.sexybeam.me:80
zbot.sexybeam.me:22
zbot.sexybeam.me:8080
zbot.sexybeam.me:8880
zbot.sexybeam.me:2052
zbot.sexybeam.me:2082
zbot.sexybeam.me:2086
zbot.sexybeam.me:2095
zbot.sexybeam.me:443
zbot.sexybeam.me:2053
zbot.sexybeam.me:2083
zbot.sexybeam.me:2087
zbot.sexybeam.me:2096
zbot.sexybeam.me:8443

Mutex

qCmDFV9nydKE

Attributes

delay
0
install
true
install_file
nmiq02.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6eb2354dfde5f22a8296e76b39a4df36982f7b0d6a0308965c81c0067d5a4c43
- Size 45KB
- SHA256 6eb2354dfde5f22a8296e76b39a4df36982f7b0d6a0308965c81c0067d5a4c43
- MD5 d959331882be4ac3d953198d71d7005e
- SHA1 09a5f9c2a4b3421e2f6adad3e1fb2d12a1a45ccf
- SHA512 bb8b31367b75cbcbffb26b01f223f4e722ac3571ac4a77bfc497a6c0e92539af43e2d8edf2f2ba9e24c2342f419c8e9bea7a1c8e4b54ae11da93c3b8c38ffe66
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ICXtTtSPI/zjb7gX3iT4hH3U9nqwPF4DsAXBDZsx:EulCJTHl42fwx/3bEXSTkknLN4fdsx
- TLSH
  T1AA231B0037E9C13BF2BE4F78A9F26145867AF6633603E58D1CC4419B5623BC59A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2