asyncrat | a236eba2f31d70b567f979c4a3ec44e6b59d13a2a2e6a431b170ae369e4d4c6c

Sharing

Copy URL Twitter E-mail

General

Target
a236eba2f31d70b567f979c4a3ec44e6b59d13a2a2e6a431b170ae369e4d4c6c
Size 45KB
Sample260815-ym4lnasgld
SHA256 a236eba2f31d70b567f979c4a3ec44e6b59d13a2a2e6a431b170ae369e4d4c6c
MD5 a8d86d1b7ae201fb54051e6a67bd7b91
SHA1 ac223926cd16931e2c2e1f1ac6326e86c9edd794
SHA512 5491ce6dd70371e9b13c95a3a9d44b901c56b5a6f69678467b12fd502925f2b394b5c588881d45571dfeb60ce22d768b4c58ec787dc9086c300a94af78d4aa2e
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFQeeXKSocbbbQtN8/nPI6kzjbAgX3iI1Xen+HuKU2bT:MuLAZTnbg2YeH2tNKA6k3bnXSIVeArVP
TLSH
T1FF233B103BE8812BF27F4FB8A9F26145867AF6633603D54E2CC4519B4613FC58A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hentaiz.bot:80
hentaiz.bot:22
hentaiz.bot:8080
hentaiz.bot:8880
hentaiz.bot:2052
hentaiz.bot:2082
hentaiz.bot:2086
hentaiz.bot:2095
hentaiz.bot:443
hentaiz.bot:2053
hentaiz.bot:2083
hentaiz.bot:2087
hentaiz.bot:2096
hentaiz.bot:8443
www.hentaiz.bot:80
www.hentaiz.bot:22
www.hentaiz.bot:8080
www.hentaiz.bot:8880
www.hentaiz.bot:2052
www.hentaiz.bot:2082
www.hentaiz.bot:2086
www.hentaiz.bot:2095
www.hentaiz.bot:443
www.hentaiz.bot:2053
www.hentaiz.bot:2083
www.hentaiz.bot:2087
www.hentaiz.bot:2096
www.hentaiz.bot:8443
trisis.hentaiz.bot:80
trisis.hentaiz.bot:22
trisis.hentaiz.bot:8080
trisis.hentaiz.bot:8880
trisis.hentaiz.bot:2052
trisis.hentaiz.bot:2082
trisis.hentaiz.bot:2086
trisis.hentaiz.bot:2095
trisis.hentaiz.bot:443
trisis.hentaiz.bot:2053
trisis.hentaiz.bot:2083
trisis.hentaiz.bot:2087
trisis.hentaiz.bot:2096
trisis.hentaiz.bot:8443
formbook.hentaiz.bot:80
formbook.hentaiz.bot:22
formbook.hentaiz.bot:8080
formbook.hentaiz.bot:8880
formbook.hentaiz.bot:2052
formbook.hentaiz.bot:2082
formbook.hentaiz.bot:2086
formbook.hentaiz.bot:2095
formbook.hentaiz.bot:443
formbook.hentaiz.bot:2053
formbook.hentaiz.bot:2083
formbook.hentaiz.bot:2087
formbook.hentaiz.bot:2096
formbook.hentaiz.bot:8443
remcos.hentaiz.bot:80
remcos.hentaiz.bot:22
remcos.hentaiz.bot:8080
remcos.hentaiz.bot:8880
remcos.hentaiz.bot:2052
remcos.hentaiz.bot:2082
remcos.hentaiz.bot:2086
remcos.hentaiz.bot:2095
remcos.hentaiz.bot:443
remcos.hentaiz.bot:2053
remcos.hentaiz.bot:2083
remcos.hentaiz.bot:2087
remcos.hentaiz.bot:2096
remcos.hentaiz.bot:8443
ryuk.hentaiz.bot:80
ryuk.hentaiz.bot:22
ryuk.hentaiz.bot:8080
ryuk.hentaiz.bot:8880
ryuk.hentaiz.bot:2052
ryuk.hentaiz.bot:2082
ryuk.hentaiz.bot:2086
ryuk.hentaiz.bot:2095
ryuk.hentaiz.bot:443
ryuk.hentaiz.bot:2053
ryuk.hentaiz.bot:2083
ryuk.hentaiz.bot:2087
ryuk.hentaiz.bot:2096
ryuk.hentaiz.bot:8443

Mutex

VqVAjK910XhH

Attributes

delay
0
install
true
install_file
dlfjx.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a236eba2f31d70b567f979c4a3ec44e6b59d13a2a2e6a431b170ae369e4d4c6c
- Size 45KB
- SHA256 a236eba2f31d70b567f979c4a3ec44e6b59d13a2a2e6a431b170ae369e4d4c6c
- MD5 a8d86d1b7ae201fb54051e6a67bd7b91
- SHA1 ac223926cd16931e2c2e1f1ac6326e86c9edd794
- SHA512 5491ce6dd70371e9b13c95a3a9d44b901c56b5a6f69678467b12fd502925f2b394b5c588881d45571dfeb60ce22d768b4c58ec787dc9086c300a94af78d4aa2e
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFQeeXKSocbbbQtN8/nPI6kzjbAgX3iI1Xen+HuKU2bT:MuLAZTnbg2YeH2tNKA6k3bnXSIVeArVP
- TLSH
  T1FF233B103BE8812BF27F4FB8A9F26145867AF6633603D54E2CC4519B4613FC58A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2