asyncrat | 5eb4da861ff750953d46fe2bb01d555f676e450dc62bd0a11848e31e391affc2

Sharing

Copy URL Twitter E-mail

General

Target
5eb4da861ff750953d46fe2bb01d555f676e450dc62bd0a11848e31e391affc2
Size 45KB
Sample260816-rkc8csdg92
SHA256 5eb4da861ff750953d46fe2bb01d555f676e450dc62bd0a11848e31e391affc2
MD5 033bc051d0d60fab3f56d050c0c3f181
SHA1 d24eeca6a5870d071f5e528498fd01879725e592
SHA512 1885bc5028fbfb10150fd1750f5f077a77b97ffd5bb81f47c4ffc54ed3fa8b190d9e1d05b8b861f8234d73a619134ba841d828a0838b7e61d1d36a6f63af99f3
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97S7synzuOPIzzjb6gX1ilo0ciu5m1r6OBDZsx:EufspTf2g22SYh3z3btXklo0ciuirhdu
TLSH
T17F232A003BE8813BF2BE5F78A9F26145467AF6632603D54A1CC451DB5723FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hentaiz.bot:80
hentaiz.bot:22
hentaiz.bot:8080
hentaiz.bot:8880
hentaiz.bot:2052
hentaiz.bot:2082
hentaiz.bot:2086
hentaiz.bot:2095
hentaiz.bot:443
hentaiz.bot:2053
hentaiz.bot:2083
hentaiz.bot:2087
hentaiz.bot:2096
hentaiz.bot:8443
www.hentaiz.bot:80
www.hentaiz.bot:22
www.hentaiz.bot:8080
www.hentaiz.bot:8880
www.hentaiz.bot:2052
www.hentaiz.bot:2082
www.hentaiz.bot:2086
www.hentaiz.bot:2095
www.hentaiz.bot:443
www.hentaiz.bot:2053
www.hentaiz.bot:2083
www.hentaiz.bot:2087
www.hentaiz.bot:2096
www.hentaiz.bot:8443
nanocore.hentaiz.bot:80
nanocore.hentaiz.bot:22
nanocore.hentaiz.bot:8080
nanocore.hentaiz.bot:8880
nanocore.hentaiz.bot:2052
nanocore.hentaiz.bot:2082
nanocore.hentaiz.bot:2086
nanocore.hentaiz.bot:2095
nanocore.hentaiz.bot:443
nanocore.hentaiz.bot:2053
nanocore.hentaiz.bot:2083
nanocore.hentaiz.bot:2087
nanocore.hentaiz.bot:2096
nanocore.hentaiz.bot:8443
qakbot.hentaiz.bot:80
qakbot.hentaiz.bot:22
qakbot.hentaiz.bot:8080
qakbot.hentaiz.bot:8880
qakbot.hentaiz.bot:2052
qakbot.hentaiz.bot:2082
qakbot.hentaiz.bot:2086
qakbot.hentaiz.bot:2095
qakbot.hentaiz.bot:443
qakbot.hentaiz.bot:2053
qakbot.hentaiz.bot:2083
qakbot.hentaiz.bot:2087
qakbot.hentaiz.bot:2096
qakbot.hentaiz.bot:8443
locky.hentaiz.bot:80
locky.hentaiz.bot:22
locky.hentaiz.bot:8080
locky.hentaiz.bot:8880
locky.hentaiz.bot:2052
locky.hentaiz.bot:2082
locky.hentaiz.bot:2086
locky.hentaiz.bot:2095
locky.hentaiz.bot:443
locky.hentaiz.bot:2053
locky.hentaiz.bot:2083
locky.hentaiz.bot:2087
locky.hentaiz.bot:2096
locky.hentaiz.bot:8443
client.hentaiz.bot:80
client.hentaiz.bot:22
client.hentaiz.bot:8080
client.hentaiz.bot:8880
client.hentaiz.bot:2052
client.hentaiz.bot:2082
client.hentaiz.bot:2086
client.hentaiz.bot:2095
client.hentaiz.bot:443
client.hentaiz.bot:2053
client.hentaiz.bot:2083
client.hentaiz.bot:2087
client.hentaiz.bot:2096
client.hentaiz.bot:8443

Mutex

KXokXAuTJDAj

Attributes

delay
0
install
true
install_file
3wgnkko.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5eb4da861ff750953d46fe2bb01d555f676e450dc62bd0a11848e31e391affc2
- Size 45KB
- SHA256 5eb4da861ff750953d46fe2bb01d555f676e450dc62bd0a11848e31e391affc2
- MD5 033bc051d0d60fab3f56d050c0c3f181
- SHA1 d24eeca6a5870d071f5e528498fd01879725e592
- SHA512 1885bc5028fbfb10150fd1750f5f077a77b97ffd5bb81f47c4ffc54ed3fa8b190d9e1d05b8b861f8234d73a619134ba841d828a0838b7e61d1d36a6f63af99f3
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97S7synzuOPIzzjb6gX1ilo0ciu5m1r6OBDZsx:EufspTf2g22SYh3z3btXklo0ciuirhdu
- TLSH
  T17F232A003BE8813BF2BE5F78A9F26145467AF6632603D54A1CC451DB5723FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2