asyncrat | 1a16c602c0586c64c8140c29d496b1a8666e0cc79ffecb8930b494439e4c6e63

Sharing

Copy URL Twitter E-mail

General

Target
1a16c602c0586c64c8140c29d496b1a8666e0cc79ffecb8930b494439e4c6e63
Size 45KB
Sample260821-r2cm6abh33
SHA256 1a16c602c0586c64c8140c29d496b1a8666e0cc79ffecb8930b494439e4c6e63
MD5 9edb32dc61cc96b2fa840d09258292e5
SHA1 3351537a29fd63e234dd8b8890bc54efbc56efd7
SHA512 c6b8c2cb52643b53285105861e1872c0a6d4bf589ccd2d7926c7d7f6f00caf91dc5c778639752619a45b3de1ece6f56bdd27fcba0280e7ba256aa86fa44f44c0
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3xY6aZOOPIgzjbcgr3iuvUJI2GoivGJr8KBDZEx:MuLAZTnbg2Ru/O3g3bzrSuvvoivur8UE
TLSH
T145232A003BE8812BF2BE4F78ACF26145867AF1676603D58D1CC451DB5B23BC696426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hentaiz.bot:80
hentaiz.bot:22
hentaiz.bot:8080
hentaiz.bot:8880
hentaiz.bot:2052
hentaiz.bot:2082
hentaiz.bot:2086
hentaiz.bot:2095
hentaiz.bot:443
hentaiz.bot:2053
hentaiz.bot:2083
hentaiz.bot:2087
hentaiz.bot:2096
hentaiz.bot:8443
www.hentaiz.bot:80
www.hentaiz.bot:22
www.hentaiz.bot:8080
www.hentaiz.bot:8880
www.hentaiz.bot:2052
www.hentaiz.bot:2082
www.hentaiz.bot:2086
www.hentaiz.bot:2095
www.hentaiz.bot:443
www.hentaiz.bot:2053
www.hentaiz.bot:2083
www.hentaiz.bot:2087
www.hentaiz.bot:2096
www.hentaiz.bot:8443
trickbot.hentaiz.bot:80
trickbot.hentaiz.bot:22
trickbot.hentaiz.bot:8080
trickbot.hentaiz.bot:8880
trickbot.hentaiz.bot:2052
trickbot.hentaiz.bot:2082
trickbot.hentaiz.bot:2086
trickbot.hentaiz.bot:2095
trickbot.hentaiz.bot:443
trickbot.hentaiz.bot:2053
trickbot.hentaiz.bot:2083
trickbot.hentaiz.bot:2087
trickbot.hentaiz.bot:2096
trickbot.hentaiz.bot:8443
blaster.hentaiz.bot:80
blaster.hentaiz.bot:22
blaster.hentaiz.bot:8080
blaster.hentaiz.bot:8880
blaster.hentaiz.bot:2052
blaster.hentaiz.bot:2082
blaster.hentaiz.bot:2086
blaster.hentaiz.bot:2095
blaster.hentaiz.bot:443
blaster.hentaiz.bot:2053
blaster.hentaiz.bot:2083
blaster.hentaiz.bot:2087
blaster.hentaiz.bot:2096
blaster.hentaiz.bot:8443
codered.hentaiz.bot:80
codered.hentaiz.bot:22
codered.hentaiz.bot:8080
codered.hentaiz.bot:8880
codered.hentaiz.bot:2052
codered.hentaiz.bot:2082
codered.hentaiz.bot:2086
codered.hentaiz.bot:2095
codered.hentaiz.bot:443
codered.hentaiz.bot:2053
codered.hentaiz.bot:2083
codered.hentaiz.bot:2087
codered.hentaiz.bot:2096
codered.hentaiz.bot:8443
agenttesla.hentaiz.bot:80
agenttesla.hentaiz.bot:22
agenttesla.hentaiz.bot:8080
agenttesla.hentaiz.bot:8880
agenttesla.hentaiz.bot:2052
agenttesla.hentaiz.bot:2082
agenttesla.hentaiz.bot:2086
agenttesla.hentaiz.bot:2095
agenttesla.hentaiz.bot:443
agenttesla.hentaiz.bot:2053
agenttesla.hentaiz.bot:2083
agenttesla.hentaiz.bot:2087
agenttesla.hentaiz.bot:2096
agenttesla.hentaiz.bot:8443

Mutex

XQ5yAjIu7SGD

Attributes

delay
0
install
true
install_file
n05vi.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1a16c602c0586c64c8140c29d496b1a8666e0cc79ffecb8930b494439e4c6e63
- Size 45KB
- SHA256 1a16c602c0586c64c8140c29d496b1a8666e0cc79ffecb8930b494439e4c6e63
- MD5 9edb32dc61cc96b2fa840d09258292e5
- SHA1 3351537a29fd63e234dd8b8890bc54efbc56efd7
- SHA512 c6b8c2cb52643b53285105861e1872c0a6d4bf589ccd2d7926c7d7f6f00caf91dc5c778639752619a45b3de1ece6f56bdd27fcba0280e7ba256aa86fa44f44c0
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3xY6aZOOPIgzjbcgr3iuvUJI2GoivGJr8KBDZEx:MuLAZTnbg2Ru/O3g3bzrSuvvoivur8UE
- TLSH
  T145232A003BE8812BF2BE4F78ACF26145867AF1676603D58D1CC451DB5B23BC696426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2