asyncrat | a370fb29ee3c5f4dc3fb8efca899c7a4de51a6a6f112c237fafe9f4fa6100a91

Sharing

Copy URL Twitter E-mail

General

Target
a370fb29ee3c5f4dc3fb8efca899c7a4de51a6a6f112c237fafe9f4fa6100a91
Size 45KB
Sample260805-qmmn5sbb64
SHA256 a370fb29ee3c5f4dc3fb8efca899c7a4de51a6a6f112c237fafe9f4fa6100a91
MD5 99d56c42ca4ab584facc89db1dbee0df
SHA1 1884b64373a1c151b1bb0f9b0a066831b3852950
SHA512 5cf5d301d51ac839de12616c337aca143400db9e9ca254960299debed924d87fd5e9a74ddbc33b7a85a2226647d26d7b6299702c07b1da13d0170b227e42b61d
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIMzjbwgX3inq2nWnb2ba4BDZEx:MuBGJTPho2Q/CFWBM3b3XS78KDdEx
TLSH
T173231A0037E9C12BF2BE4F74A9F26145867AF6632603D5491CC451DB1B23BC6CA53AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

podvid.top:80
podvid.top:22
podvid.top:8080
podvid.top:8880
podvid.top:2052
podvid.top:2082
podvid.top:2086
podvid.top:2095
podvid.top:443
podvid.top:2053
podvid.top:2083
podvid.top:2087
podvid.top:2096
podvid.top:8443
www.podvid.top:80
www.podvid.top:22
www.podvid.top:8080
www.podvid.top:8880
www.podvid.top:2052
www.podvid.top:2082
www.podvid.top:2086
www.podvid.top:2095
www.podvid.top:443
www.podvid.top:2053
www.podvid.top:2083
www.podvid.top:2087
www.podvid.top:2096
www.podvid.top:8443
formbook.podvid.top:80
formbook.podvid.top:22
formbook.podvid.top:8080
formbook.podvid.top:8880
formbook.podvid.top:2052
formbook.podvid.top:2082
formbook.podvid.top:2086
formbook.podvid.top:2095
formbook.podvid.top:443
formbook.podvid.top:2053
formbook.podvid.top:2083
formbook.podvid.top:2087
formbook.podvid.top:2096
formbook.podvid.top:8443
zeus.podvid.top:80
zeus.podvid.top:22
zeus.podvid.top:8080
zeus.podvid.top:8880
zeus.podvid.top:2052
zeus.podvid.top:2082
zeus.podvid.top:2086
zeus.podvid.top:2095
zeus.podvid.top:443
zeus.podvid.top:2053
zeus.podvid.top:2083
zeus.podvid.top:2087
zeus.podvid.top:2096
zeus.podvid.top:8443
shamoon.podvid.top:80
shamoon.podvid.top:22
shamoon.podvid.top:8080
shamoon.podvid.top:8880
shamoon.podvid.top:2052
shamoon.podvid.top:2082
shamoon.podvid.top:2086
shamoon.podvid.top:2095
shamoon.podvid.top:443
shamoon.podvid.top:2053
shamoon.podvid.top:2083
shamoon.podvid.top:2087
shamoon.podvid.top:2096
shamoon.podvid.top:8443
cryptolocker.podvid.top:80
cryptolocker.podvid.top:22
cryptolocker.podvid.top:8080
cryptolocker.podvid.top:8880
cryptolocker.podvid.top:2052
cryptolocker.podvid.top:2082
cryptolocker.podvid.top:2086
cryptolocker.podvid.top:2095
cryptolocker.podvid.top:443
cryptolocker.podvid.top:2053
cryptolocker.podvid.top:2083
cryptolocker.podvid.top:2087
cryptolocker.podvid.top:2096
cryptolocker.podvid.top:8443

Mutex

08x1Nu3PqZNE

Attributes

delay
0
install
true
install_file
p5ib.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a370fb29ee3c5f4dc3fb8efca899c7a4de51a6a6f112c237fafe9f4fa6100a91
- Size 45KB
- SHA256 a370fb29ee3c5f4dc3fb8efca899c7a4de51a6a6f112c237fafe9f4fa6100a91
- MD5 99d56c42ca4ab584facc89db1dbee0df
- SHA1 1884b64373a1c151b1bb0f9b0a066831b3852950
- SHA512 5cf5d301d51ac839de12616c337aca143400db9e9ca254960299debed924d87fd5e9a74ddbc33b7a85a2226647d26d7b6299702c07b1da13d0170b227e42b61d
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIMzjbwgX3inq2nWnb2ba4BDZEx:MuBGJTPho2Q/CFWBM3b3XS78KDdEx
- TLSH
  T173231A0037E9C12BF2BE4F74A9F26145867AF6632603D5491CC451DB1B23BC6CA53AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2