asyncrat | dad52ed7fcf64205b369e3d5a1cbd8eca13a49d948712113ef05d0591d306063

Sharing

Copy URL Twitter E-mail

General

Target
dad52ed7fcf64205b369e3d5a1cbd8eca13a49d948712113ef05d0591d306063
Size 45KB
Sample260905-g344payarh
SHA256 dad52ed7fcf64205b369e3d5a1cbd8eca13a49d948712113ef05d0591d306063
MD5 944f20f9a81aaeca77da9da3c3e30e55
SHA1 a034629acfce98bd2a35813232a87c5204060800
SHA512 63c45ac85d7609122fe399cbc1313775e73877f86c71155e677c054ef993f95762c74e4e63458f6bf48f397a8667b2fad0d56a36e6187473ffb23a040e9a0079
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPILzjbcgX3icR1xbWDVvsFZmLLBDZEx:MuLAZTnbg2O4Ea7L3bzXSczQFsFZmhdG
TLSH
T141232C003BE8822BF1BE4F78ADF261054A7EF6736603D5491CC452975A13FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexvn99.com:80
sexvn99.com:22
sexvn99.com:8080
sexvn99.com:8880
sexvn99.com:2052
sexvn99.com:2082
sexvn99.com:2086
sexvn99.com:2095
sexvn99.com:443
sexvn99.com:2053
sexvn99.com:2083
sexvn99.com:2087
sexvn99.com:2096
sexvn99.com:8443
www.sexvn99.com:80
www.sexvn99.com:22
www.sexvn99.com:8080
www.sexvn99.com:8880
www.sexvn99.com:2052
www.sexvn99.com:2082
www.sexvn99.com:2086
www.sexvn99.com:2095
www.sexvn99.com:443
www.sexvn99.com:2053
www.sexvn99.com:2083
www.sexvn99.com:2087
www.sexvn99.com:2096
www.sexvn99.com:8443
cl0p.sexvn99.com:80
cl0p.sexvn99.com:22
cl0p.sexvn99.com:8080
cl0p.sexvn99.com:8880
cl0p.sexvn99.com:2052
cl0p.sexvn99.com:2082
cl0p.sexvn99.com:2086
cl0p.sexvn99.com:2095
cl0p.sexvn99.com:443
cl0p.sexvn99.com:2053
cl0p.sexvn99.com:2083
cl0p.sexvn99.com:2087
cl0p.sexvn99.com:2096
cl0p.sexvn99.com:8443
invasive.sexvn99.com:80
invasive.sexvn99.com:22
invasive.sexvn99.com:8080
invasive.sexvn99.com:8880
invasive.sexvn99.com:2052
invasive.sexvn99.com:2082
invasive.sexvn99.com:2086
invasive.sexvn99.com:2095
invasive.sexvn99.com:443
invasive.sexvn99.com:2053
invasive.sexvn99.com:2083
invasive.sexvn99.com:2087
invasive.sexvn99.com:2096
invasive.sexvn99.com:8443
nanocore.sexvn99.com:80
nanocore.sexvn99.com:22
nanocore.sexvn99.com:8080
nanocore.sexvn99.com:8880
nanocore.sexvn99.com:2052
nanocore.sexvn99.com:2082
nanocore.sexvn99.com:2086
nanocore.sexvn99.com:2095
nanocore.sexvn99.com:443
nanocore.sexvn99.com:2053
nanocore.sexvn99.com:2083
nanocore.sexvn99.com:2087
nanocore.sexvn99.com:2096
nanocore.sexvn99.com:8443
codered.sexvn99.com:80
codered.sexvn99.com:22
codered.sexvn99.com:8080
codered.sexvn99.com:8880
codered.sexvn99.com:2052
codered.sexvn99.com:2082
codered.sexvn99.com:2086
codered.sexvn99.com:2095
codered.sexvn99.com:443
codered.sexvn99.com:2053
codered.sexvn99.com:2083
codered.sexvn99.com:2087
codered.sexvn99.com:2096
codered.sexvn99.com:8443

Mutex

CJtAXtRQwNDI

Attributes

delay
0
install
true
install_file
53084.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  dad52ed7fcf64205b369e3d5a1cbd8eca13a49d948712113ef05d0591d306063
- Size 45KB
- SHA256 dad52ed7fcf64205b369e3d5a1cbd8eca13a49d948712113ef05d0591d306063
- MD5 944f20f9a81aaeca77da9da3c3e30e55
- SHA1 a034629acfce98bd2a35813232a87c5204060800
- SHA512 63c45ac85d7609122fe399cbc1313775e73877f86c71155e677c054ef993f95762c74e4e63458f6bf48f397a8667b2fad0d56a36e6187473ffb23a040e9a0079
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPILzjbcgX3icR1xbWDVvsFZmLLBDZEx:MuLAZTnbg2O4Ea7L3bzXSczQFsFZmhdG
- TLSH
  T141232C003BE8822BF1BE4F78ADF261054A7EF6736603D5491CC452975A13FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2