asyncrat | 1f76abec3e0c4477908e8b55f6f21f95df1024c1ccddc67d5b8b9352480035d4

Sharing

Copy URL Twitter E-mail

General

Target
1f76abec3e0c4477908e8b55f6f21f95df1024c1ccddc67d5b8b9352480035d4
Size 45KB
Sample260816-jf5g2ssflg
SHA256 1f76abec3e0c4477908e8b55f6f21f95df1024c1ccddc67d5b8b9352480035d4
MD5 8d1099eb4084d1b869ae51a155a252be
SHA1 b24ab19f5832fab5965e97c4d305741c2a2efc33
SHA512 b914d64278e8f9d1a5a726335d137ad19b9bdcc8b4439d4b893e9c92a159b42347ba94504bdb6102b1d4226741520ea8cd4e7593814201d4759285ea0882456c
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9IDEbHBOjTOPI/TzjbrgX3iXIVdwfWmU7sV4wcBDZ+:0u1YJTHcw2HyYf3/T3bUXSXIuemyssd+
TLSH
T1A1230A0037E8822BF27E4F78A9F26145867AF6633A03D5491CC452DB5723FC59A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hentaiz.bot:80
hentaiz.bot:22
hentaiz.bot:8080
hentaiz.bot:8880
hentaiz.bot:2052
hentaiz.bot:2082
hentaiz.bot:2086
hentaiz.bot:2095
hentaiz.bot:443
hentaiz.bot:2053
hentaiz.bot:2083
hentaiz.bot:2087
hentaiz.bot:2096
hentaiz.bot:8443
www.hentaiz.bot:80
www.hentaiz.bot:22
www.hentaiz.bot:8080
www.hentaiz.bot:8880
www.hentaiz.bot:2052
www.hentaiz.bot:2082
www.hentaiz.bot:2086
www.hentaiz.bot:2095
www.hentaiz.bot:443
www.hentaiz.bot:2053
www.hentaiz.bot:2083
www.hentaiz.bot:2087
www.hentaiz.bot:2096
www.hentaiz.bot:8443
mirai.hentaiz.bot:80
mirai.hentaiz.bot:22
mirai.hentaiz.bot:8080
mirai.hentaiz.bot:8880
mirai.hentaiz.bot:2052
mirai.hentaiz.bot:2082
mirai.hentaiz.bot:2086
mirai.hentaiz.bot:2095
mirai.hentaiz.bot:443
mirai.hentaiz.bot:2053
mirai.hentaiz.bot:2083
mirai.hentaiz.bot:2087
mirai.hentaiz.bot:2096
mirai.hentaiz.bot:8443
downadup.hentaiz.bot:80
downadup.hentaiz.bot:22
downadup.hentaiz.bot:8080
downadup.hentaiz.bot:8880
downadup.hentaiz.bot:2052
downadup.hentaiz.bot:2082
downadup.hentaiz.bot:2086
downadup.hentaiz.bot:2095
downadup.hentaiz.bot:443
downadup.hentaiz.bot:2053
downadup.hentaiz.bot:2083
downadup.hentaiz.bot:2087
downadup.hentaiz.bot:2096
downadup.hentaiz.bot:8443
industroyer.hentaiz.bot:80
industroyer.hentaiz.bot:22
industroyer.hentaiz.bot:8080
industroyer.hentaiz.bot:8880
industroyer.hentaiz.bot:2052
industroyer.hentaiz.bot:2082
industroyer.hentaiz.bot:2086
industroyer.hentaiz.bot:2095
industroyer.hentaiz.bot:443
industroyer.hentaiz.bot:2053
industroyer.hentaiz.bot:2083
industroyer.hentaiz.bot:2087
industroyer.hentaiz.bot:2096
industroyer.hentaiz.bot:8443

Mutex

CLCJV5XoXsWf

Attributes

delay
0
install
true
install_file
8lrl7x.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1f76abec3e0c4477908e8b55f6f21f95df1024c1ccddc67d5b8b9352480035d4
- Size 45KB
- SHA256 1f76abec3e0c4477908e8b55f6f21f95df1024c1ccddc67d5b8b9352480035d4
- MD5 8d1099eb4084d1b869ae51a155a252be
- SHA1 b24ab19f5832fab5965e97c4d305741c2a2efc33
- SHA512 b914d64278e8f9d1a5a726335d137ad19b9bdcc8b4439d4b893e9c92a159b42347ba94504bdb6102b1d4226741520ea8cd4e7593814201d4759285ea0882456c
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9IDEbHBOjTOPI/TzjbrgX3iXIVdwfWmU7sV4wcBDZ+:0u1YJTHcw2HyYf3/T3bUXSXIuemyssd+
- TLSH
  T1A1230A0037E8822BF27E4F78A9F26145867AF6633A03D5491CC452DB5723FC59A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2