asyncrat | 2b51b6e5cb7aabac7b3595554782700de74b875ec824840eb4495eb8df1bcd19

Sharing

Copy URL Twitter E-mail

General

Target
2b51b6e5cb7aabac7b3595554782700de74b875ec824840eb4495eb8df1bcd19
Size 45KB
Sample260815-xxtc1aszex
SHA256 2b51b6e5cb7aabac7b3595554782700de74b875ec824840eb4495eb8df1bcd19
MD5 dd62305624d0f861c10967dc490b1409
SHA1 b0cbb2a51653b112075c6f457e10f324c8c69bc1
SHA512 bcf411db32f251a49e6d04849a741dd5f7775984f97a1697e6c7d51de326c40fb1c8b23b106e2d8cea499d735f3786f69b236eb6462aa9d83915966ced819d9f
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwlm/9GgROPIpzjbkgX3izYV3k/hG4AIQLh1pSBDZMx:ku40ZTXEb2xm1h3p3brXSlg4wLxsdMx
TLSH
T193232B003BE8C22BF27E8F789DF26145467AF6A32603D54D1CC452DB5613BC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mio9ecge.name:80
mio9ecge.name:22
mio9ecge.name:8080
mio9ecge.name:8880
mio9ecge.name:2052
mio9ecge.name:2082
mio9ecge.name:2086
mio9ecge.name:2095
mio9ecge.name:443
mio9ecge.name:2053
mio9ecge.name:2083
mio9ecge.name:2087
mio9ecge.name:2096
mio9ecge.name:8443
www.mio9ecge.name:80
www.mio9ecge.name:22
www.mio9ecge.name:8080
www.mio9ecge.name:8880
www.mio9ecge.name:2052
www.mio9ecge.name:2082
www.mio9ecge.name:2086
www.mio9ecge.name:2095
www.mio9ecge.name:443
www.mio9ecge.name:2053
www.mio9ecge.name:2083
www.mio9ecge.name:2087
www.mio9ecge.name:2096
www.mio9ecge.name:8443
malware.mio9ecge.name:80
malware.mio9ecge.name:22
malware.mio9ecge.name:8080
malware.mio9ecge.name:8880
malware.mio9ecge.name:2052
malware.mio9ecge.name:2082
malware.mio9ecge.name:2086
malware.mio9ecge.name:2095
malware.mio9ecge.name:443
malware.mio9ecge.name:2053
malware.mio9ecge.name:2083
malware.mio9ecge.name:2087
malware.mio9ecge.name:2096
malware.mio9ecge.name:8443
mirai.mio9ecge.name:80
mirai.mio9ecge.name:22
mirai.mio9ecge.name:8080
mirai.mio9ecge.name:8880
mirai.mio9ecge.name:2052
mirai.mio9ecge.name:2082
mirai.mio9ecge.name:2086
mirai.mio9ecge.name:2095
mirai.mio9ecge.name:443
mirai.mio9ecge.name:2053
mirai.mio9ecge.name:2083
mirai.mio9ecge.name:2087
mirai.mio9ecge.name:2096
mirai.mio9ecge.name:8443
wannacry.mio9ecge.name:80
wannacry.mio9ecge.name:22
wannacry.mio9ecge.name:8080
wannacry.mio9ecge.name:8880
wannacry.mio9ecge.name:2052
wannacry.mio9ecge.name:2082
wannacry.mio9ecge.name:2086
wannacry.mio9ecge.name:2095
wannacry.mio9ecge.name:443
wannacry.mio9ecge.name:2053
wannacry.mio9ecge.name:2083
wannacry.mio9ecge.name:2087
wannacry.mio9ecge.name:2096
wannacry.mio9ecge.name:8443
client.mio9ecge.name:80
client.mio9ecge.name:22
client.mio9ecge.name:8080
client.mio9ecge.name:8880
client.mio9ecge.name:2052
client.mio9ecge.name:2082
client.mio9ecge.name:2086
client.mio9ecge.name:2095
client.mio9ecge.name:443
client.mio9ecge.name:2053
client.mio9ecge.name:2083
client.mio9ecge.name:2087
client.mio9ecge.name:2096
client.mio9ecge.name:8443

Mutex

RZu82arGA3G6

Attributes

delay
0
install
true
install_file
w6zhg.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2b51b6e5cb7aabac7b3595554782700de74b875ec824840eb4495eb8df1bcd19
- Size 45KB
- SHA256 2b51b6e5cb7aabac7b3595554782700de74b875ec824840eb4495eb8df1bcd19
- MD5 dd62305624d0f861c10967dc490b1409
- SHA1 b0cbb2a51653b112075c6f457e10f324c8c69bc1
- SHA512 bcf411db32f251a49e6d04849a741dd5f7775984f97a1697e6c7d51de326c40fb1c8b23b106e2d8cea499d735f3786f69b236eb6462aa9d83915966ced819d9f
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwlm/9GgROPIpzjbkgX3izYV3k/hG4AIQLh1pSBDZMx:ku40ZTXEb2xm1h3p3brXSlg4wLxsdMx
- TLSH
  T193232B003BE8C22BF27E8F789DF26145467AF6A32603D54D1CC452DB5613BC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2