asyncrat | 4fa66555b765395aa984ddf128b9cfed056093e42e7bec962744c17fa9242aae

Sharing

Copy URL Twitter E-mail

General

Target
4fa66555b765395aa984ddf128b9cfed056093e42e7bec962744c17fa9242aae
Size 45KB
Sample260816-pewfmsan3z
SHA256 4fa66555b765395aa984ddf128b9cfed056093e42e7bec962744c17fa9242aae
MD5 493c87248a31c1f1fdfb8f9340d9fe19
SHA1 1c2ddf814eabbac9210951a6d21e830a58dacded
SHA512 c28a265fac11c4a3e6a7be3c0428fdea2e8ba936ee43c92477639a5b7bf778383e4bc0ccce475117506423b3ca6e3fd9fdba768c3705d04c416015e043c90c88
SSDEEP 768:IuR0JTPUYkEWUmjWymo2q1/sD/pneqPIkzjbxgX3iiF/webdflTMd7BDZox:IuR0JTPjY2ksjJeTk3b+XSyFdmdox
TLSH
T1CA233B003BE9822BF2BE4F78A9F26145867BF1732603D5891CC451D75623FC68A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hentaiz.bot:80
hentaiz.bot:22
hentaiz.bot:8080
hentaiz.bot:8880
hentaiz.bot:2052
hentaiz.bot:2082
hentaiz.bot:2086
hentaiz.bot:2095
hentaiz.bot:443
hentaiz.bot:2053
hentaiz.bot:2083
hentaiz.bot:2087
hentaiz.bot:2096
hentaiz.bot:8443
www.hentaiz.bot:80
www.hentaiz.bot:22
www.hentaiz.bot:8080
www.hentaiz.bot:8880
www.hentaiz.bot:2052
www.hentaiz.bot:2082
www.hentaiz.bot:2086
www.hentaiz.bot:2095
www.hentaiz.bot:443
www.hentaiz.bot:2053
www.hentaiz.bot:2083
www.hentaiz.bot:2087
www.hentaiz.bot:2096
www.hentaiz.bot:8443
formbook.hentaiz.bot:80
formbook.hentaiz.bot:22
formbook.hentaiz.bot:8080
formbook.hentaiz.bot:8880
formbook.hentaiz.bot:2052
formbook.hentaiz.bot:2082
formbook.hentaiz.bot:2086
formbook.hentaiz.bot:2095
formbook.hentaiz.bot:443
formbook.hentaiz.bot:2053
formbook.hentaiz.bot:2083
formbook.hentaiz.bot:2087
formbook.hentaiz.bot:2096
formbook.hentaiz.bot:8443
remote.hentaiz.bot:80
remote.hentaiz.bot:22
remote.hentaiz.bot:8080
remote.hentaiz.bot:8880
remote.hentaiz.bot:2052
remote.hentaiz.bot:2082
remote.hentaiz.bot:2086
remote.hentaiz.bot:2095
remote.hentaiz.bot:443
remote.hentaiz.bot:2053
remote.hentaiz.bot:2083
remote.hentaiz.bot:2087
remote.hentaiz.bot:2096
remote.hentaiz.bot:8443
gootloader.hentaiz.bot:80
gootloader.hentaiz.bot:22
gootloader.hentaiz.bot:8080
gootloader.hentaiz.bot:8880
gootloader.hentaiz.bot:2052
gootloader.hentaiz.bot:2082
gootloader.hentaiz.bot:2086
gootloader.hentaiz.bot:2095
gootloader.hentaiz.bot:443
gootloader.hentaiz.bot:2053
gootloader.hentaiz.bot:2083
gootloader.hentaiz.bot:2087
gootloader.hentaiz.bot:2096
gootloader.hentaiz.bot:8443

Mutex

klweStyA4TIX

Attributes

delay
0
install
true
install_file
s4bv.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4fa66555b765395aa984ddf128b9cfed056093e42e7bec962744c17fa9242aae
- Size 45KB
- SHA256 4fa66555b765395aa984ddf128b9cfed056093e42e7bec962744c17fa9242aae
- MD5 493c87248a31c1f1fdfb8f9340d9fe19
- SHA1 1c2ddf814eabbac9210951a6d21e830a58dacded
- SHA512 c28a265fac11c4a3e6a7be3c0428fdea2e8ba936ee43c92477639a5b7bf778383e4bc0ccce475117506423b3ca6e3fd9fdba768c3705d04c416015e043c90c88
- SSDEEP 768:IuR0JTPUYkEWUmjWymo2q1/sD/pneqPIkzjbxgX3iiF/webdflTMd7BDZox:IuR0JTPjY2ksjJeTk3b+XSyFdmdox
- TLSH
  T1CA233B003BE9822BF2BE4F78A9F26145867BF1732603D5891CC451D75623FC68A42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2