asyncrat | 2c9efd0191df001c6f0427027e3eddbe793d5806b99fe84f4aebede993e91304

Sharing

Copy URL Twitter E-mail

General

Target
2c9efd0191df001c6f0427027e3eddbe793d5806b99fe84f4aebede993e91304
Size 45KB
Sample260816-l28spsvxaz
SHA256 2c9efd0191df001c6f0427027e3eddbe793d5806b99fe84f4aebede993e91304
MD5 b9031169e37123c81d4f61b1afe0b66d
SHA1 ab859921cb9f1e95ca644f95643f2dc62c88edd7
SHA512 0ae61bf82384656dc35221051426e93766bd49b3ea78c1e9ddaf6c8fb7aec04d174dea5406d1f216c8ce316600ec7bef842c610ff5372b63963130b729f4b8d1
SSDEEP 768:4uLAZTnAkuSWUYzG8mo2qFmTYmUGOTAPIUzjbpgX3i/KDA71vs0stFBDZ4x:4uLAZTnbg2TURTlU3bmXSH71vs0ALd4x
TLSH
T1DC232A003BE8813AF2BE4F7899F26145867AF1637603D65A1CC441DB5723FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hentaiz.bot:80
hentaiz.bot:22
hentaiz.bot:8080
hentaiz.bot:8880
hentaiz.bot:2052
hentaiz.bot:2082
hentaiz.bot:2086
hentaiz.bot:2095
hentaiz.bot:443
hentaiz.bot:2053
hentaiz.bot:2083
hentaiz.bot:2087
hentaiz.bot:2096
hentaiz.bot:8443
www.hentaiz.bot:80
www.hentaiz.bot:22
www.hentaiz.bot:8080
www.hentaiz.bot:8880
www.hentaiz.bot:2052
www.hentaiz.bot:2082
www.hentaiz.bot:2086
www.hentaiz.bot:2095
www.hentaiz.bot:443
www.hentaiz.bot:2053
www.hentaiz.bot:2083
www.hentaiz.bot:2087
www.hentaiz.bot:2096
www.hentaiz.bot:8443
klez.hentaiz.bot:80
klez.hentaiz.bot:22
klez.hentaiz.bot:8080
klez.hentaiz.bot:8880
klez.hentaiz.bot:2052
klez.hentaiz.bot:2082
klez.hentaiz.bot:2086
klez.hentaiz.bot:2095
klez.hentaiz.bot:443
klez.hentaiz.bot:2053
klez.hentaiz.bot:2083
klez.hentaiz.bot:2087
klez.hentaiz.bot:2096
klez.hentaiz.bot:8443
codered.hentaiz.bot:80
codered.hentaiz.bot:22
codered.hentaiz.bot:8080
codered.hentaiz.bot:8880
codered.hentaiz.bot:2052
codered.hentaiz.bot:2082
codered.hentaiz.bot:2086
codered.hentaiz.bot:2095
codered.hentaiz.bot:443
codered.hentaiz.bot:2053
codered.hentaiz.bot:2083
codered.hentaiz.bot:2087
codered.hentaiz.bot:2096
codered.hentaiz.bot:8443
conti.hentaiz.bot:80
conti.hentaiz.bot:22
conti.hentaiz.bot:8080
conti.hentaiz.bot:8880
conti.hentaiz.bot:2052
conti.hentaiz.bot:2082
conti.hentaiz.bot:2086
conti.hentaiz.bot:2095
conti.hentaiz.bot:443
conti.hentaiz.bot:2053
conti.hentaiz.bot:2083
conti.hentaiz.bot:2087
conti.hentaiz.bot:2096
conti.hentaiz.bot:8443
connect.hentaiz.bot:80
connect.hentaiz.bot:22
connect.hentaiz.bot:8080
connect.hentaiz.bot:8880
connect.hentaiz.bot:2052
connect.hentaiz.bot:2082
connect.hentaiz.bot:2086
connect.hentaiz.bot:2095
connect.hentaiz.bot:443
connect.hentaiz.bot:2053
connect.hentaiz.bot:2083
connect.hentaiz.bot:2087
connect.hentaiz.bot:2096
connect.hentaiz.bot:8443

Mutex

nKkGFxkEL2w8

Attributes

delay
0
install
true
install_file
43ea2.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2c9efd0191df001c6f0427027e3eddbe793d5806b99fe84f4aebede993e91304
- Size 45KB
- SHA256 2c9efd0191df001c6f0427027e3eddbe793d5806b99fe84f4aebede993e91304
- MD5 b9031169e37123c81d4f61b1afe0b66d
- SHA1 ab859921cb9f1e95ca644f95643f2dc62c88edd7
- SHA512 0ae61bf82384656dc35221051426e93766bd49b3ea78c1e9ddaf6c8fb7aec04d174dea5406d1f216c8ce316600ec7bef842c610ff5372b63963130b729f4b8d1
- SSDEEP 768:4uLAZTnAkuSWUYzG8mo2qFmTYmUGOTAPIUzjbpgX3i/KDA71vs0stFBDZ4x:4uLAZTnbg2TURTlU3bmXSH71vs0ALd4x
- TLSH
  T1DC232A003BE8813AF2BE4F7899F26145867AF1637603D65A1CC441DB5723FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2