asyncrat | 68331b308e770d2b60e1e754ad21ccab230fb83dcbdc099b340ab9773e8dd9cb

Sharing

Copy URL Twitter E-mail

General

Target
68331b308e770d2b60e1e754ad21ccab230fb83dcbdc099b340ab9773e8dd9cb
Size 45KB
Sample260816-wkhkastekc
SHA256 68331b308e770d2b60e1e754ad21ccab230fb83dcbdc099b340ab9773e8dd9cb
MD5 1de4c059099394ad19d31621c1faf0fe
SHA1 b93166a69c6cad097c70a94df354e6e61830bbbd
SHA512 99e942548a4ca0fb51c602240261c185743e20702ccea64541bac3d0a5b920fc50b661e1043c184b6703c6aad85f4c836d61b371a90d1e0901b056a33fdde706
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97iScy3zlOPIxzjbxgg3iV+/JBcY6KWsAM8BDZsx:EufspTf2g2Wi963x3b+gSVaW+adsx
TLSH
T182233C003BE9812BF2BE4F786DF26145467AF6633603D64A1CC452DB5713BC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hentaiz.bot:80
hentaiz.bot:22
hentaiz.bot:8080
hentaiz.bot:8880
hentaiz.bot:2052
hentaiz.bot:2082
hentaiz.bot:2086
hentaiz.bot:2095
hentaiz.bot:443
hentaiz.bot:2053
hentaiz.bot:2083
hentaiz.bot:2087
hentaiz.bot:2096
hentaiz.bot:8443
www.hentaiz.bot:80
www.hentaiz.bot:22
www.hentaiz.bot:8080
www.hentaiz.bot:8880
www.hentaiz.bot:2052
www.hentaiz.bot:2082
www.hentaiz.bot:2086
www.hentaiz.bot:2095
www.hentaiz.bot:443
www.hentaiz.bot:2053
www.hentaiz.bot:2083
www.hentaiz.bot:2087
www.hentaiz.bot:2096
www.hentaiz.bot:8443
sobig.hentaiz.bot:80
sobig.hentaiz.bot:22
sobig.hentaiz.bot:8080
sobig.hentaiz.bot:8880
sobig.hentaiz.bot:2052
sobig.hentaiz.bot:2082
sobig.hentaiz.bot:2086
sobig.hentaiz.bot:2095
sobig.hentaiz.bot:443
sobig.hentaiz.bot:2053
sobig.hentaiz.bot:2083
sobig.hentaiz.bot:2087
sobig.hentaiz.bot:2096
sobig.hentaiz.bot:8443
agenttesla.hentaiz.bot:80
agenttesla.hentaiz.bot:22
agenttesla.hentaiz.bot:8080
agenttesla.hentaiz.bot:8880
agenttesla.hentaiz.bot:2052
agenttesla.hentaiz.bot:2082
agenttesla.hentaiz.bot:2086
agenttesla.hentaiz.bot:2095
agenttesla.hentaiz.bot:443
agenttesla.hentaiz.bot:2053
agenttesla.hentaiz.bot:2083
agenttesla.hentaiz.bot:2087
agenttesla.hentaiz.bot:2096
agenttesla.hentaiz.bot:8443
gh0st.hentaiz.bot:80
gh0st.hentaiz.bot:22
gh0st.hentaiz.bot:8080
gh0st.hentaiz.bot:8880
gh0st.hentaiz.bot:2052
gh0st.hentaiz.bot:2082
gh0st.hentaiz.bot:2086
gh0st.hentaiz.bot:2095
gh0st.hentaiz.bot:443
gh0st.hentaiz.bot:2053
gh0st.hentaiz.bot:2083
gh0st.hentaiz.bot:2087
gh0st.hentaiz.bot:2096
gh0st.hentaiz.bot:8443
iloveyou.hentaiz.bot:80
iloveyou.hentaiz.bot:22
iloveyou.hentaiz.bot:8080
iloveyou.hentaiz.bot:8880
iloveyou.hentaiz.bot:2052
iloveyou.hentaiz.bot:2082
iloveyou.hentaiz.bot:2086
iloveyou.hentaiz.bot:2095
iloveyou.hentaiz.bot:443
iloveyou.hentaiz.bot:2053
iloveyou.hentaiz.bot:2083
iloveyou.hentaiz.bot:2087
iloveyou.hentaiz.bot:2096
iloveyou.hentaiz.bot:8443

Mutex

rusVbuBzAl8R

Attributes

delay
0
install
true
install_file
arm05dn.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  68331b308e770d2b60e1e754ad21ccab230fb83dcbdc099b340ab9773e8dd9cb
- Size 45KB
- SHA256 68331b308e770d2b60e1e754ad21ccab230fb83dcbdc099b340ab9773e8dd9cb
- MD5 1de4c059099394ad19d31621c1faf0fe
- SHA1 b93166a69c6cad097c70a94df354e6e61830bbbd
- SHA512 99e942548a4ca0fb51c602240261c185743e20702ccea64541bac3d0a5b920fc50b661e1043c184b6703c6aad85f4c836d61b371a90d1e0901b056a33fdde706
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97iScy3zlOPIxzjbxgg3iV+/JBcY6KWsAM8BDZsx:EufspTf2g2Wi963x3b+gSVaW+adsx
- TLSH
  T182233C003BE9812BF2BE4F786DF26145467AF6633603D64A1CC452DB5713BC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2