asyncrat | 5e2b475a205204cc918bf95ee7745b920e288b1fdecea201e4e6f31c1bddc171

Sharing

Copy URL Twitter E-mail

General

Target
5e2b475a205204cc918bf95ee7745b920e288b1fdecea201e4e6f31c1bddc171
Size 45KB
Sample260905-hr9epswtev
SHA256 5e2b475a205204cc918bf95ee7745b920e288b1fdecea201e4e6f31c1bddc171
MD5 b5545967a73cf8eeba7ef0c3b3899305
SHA1 3db1891e84b1257c8cad22d457d28c673a21ea2f
SHA512 13d5f0cba9b5200b575b96601955a5f57b69ff75bfc8f1bdff45b32a08c1bc36865e2811f031536a927005c2d0b4e1bc610b8582af93a9bcb884a45ad18161ca
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9VCXtTtoPIczjb6gX3i06Q44DFBGlA4BDZsx:EulCJTHl42qw3c3btXS0N44JBn+dsx
TLSH
T168231A0037E8C12BF2BE4F78A9F252454A7AF6637A02D54D2CC441DB5623FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexdam.top:80
sexdam.top:22
sexdam.top:8080
sexdam.top:8880
sexdam.top:2052
sexdam.top:2082
sexdam.top:2086
sexdam.top:2095
sexdam.top:443
sexdam.top:2053
sexdam.top:2083
sexdam.top:2087
sexdam.top:2096
sexdam.top:8443
www.sexdam.top:80
www.sexdam.top:22
www.sexdam.top:8080
www.sexdam.top:8880
www.sexdam.top:2052
www.sexdam.top:2082
www.sexdam.top:2086
www.sexdam.top:2095
www.sexdam.top:443
www.sexdam.top:2053
www.sexdam.top:2083
www.sexdam.top:2087
www.sexdam.top:2096
www.sexdam.top:8443
azorult.sexdam.top:80
azorult.sexdam.top:22
azorult.sexdam.top:8080
azorult.sexdam.top:8880
azorult.sexdam.top:2052
azorult.sexdam.top:2082
azorult.sexdam.top:2086
azorult.sexdam.top:2095
azorult.sexdam.top:443
azorult.sexdam.top:2053
azorult.sexdam.top:2083
azorult.sexdam.top:2087
azorult.sexdam.top:2096
azorult.sexdam.top:8443
triton.sexdam.top:80
triton.sexdam.top:22
triton.sexdam.top:8080
triton.sexdam.top:8880
triton.sexdam.top:2052
triton.sexdam.top:2082
triton.sexdam.top:2086
triton.sexdam.top:2095
triton.sexdam.top:443
triton.sexdam.top:2053
triton.sexdam.top:2083
triton.sexdam.top:2087
triton.sexdam.top:2096
triton.sexdam.top:8443
codered.sexdam.top:80
codered.sexdam.top:22
codered.sexdam.top:8080
codered.sexdam.top:8880
codered.sexdam.top:2052
codered.sexdam.top:2082
codered.sexdam.top:2086
codered.sexdam.top:2095
codered.sexdam.top:443
codered.sexdam.top:2053
codered.sexdam.top:2083
codered.sexdam.top:2087
codered.sexdam.top:2096
codered.sexdam.top:8443
industroyer.sexdam.top:80
industroyer.sexdam.top:22
industroyer.sexdam.top:8080
industroyer.sexdam.top:8880
industroyer.sexdam.top:2052
industroyer.sexdam.top:2082
industroyer.sexdam.top:2086
industroyer.sexdam.top:2095
industroyer.sexdam.top:443
industroyer.sexdam.top:2053
industroyer.sexdam.top:2083
industroyer.sexdam.top:2087
industroyer.sexdam.top:2096
industroyer.sexdam.top:8443

Mutex

E93oI8e7GgiK

Attributes

delay
0
install
true
install_file
3dnyd0.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5e2b475a205204cc918bf95ee7745b920e288b1fdecea201e4e6f31c1bddc171
- Size 45KB
- SHA256 5e2b475a205204cc918bf95ee7745b920e288b1fdecea201e4e6f31c1bddc171
- MD5 b5545967a73cf8eeba7ef0c3b3899305
- SHA1 3db1891e84b1257c8cad22d457d28c673a21ea2f
- SHA512 13d5f0cba9b5200b575b96601955a5f57b69ff75bfc8f1bdff45b32a08c1bc36865e2811f031536a927005c2d0b4e1bc610b8582af93a9bcb884a45ad18161ca
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9VCXtTtoPIczjb6gX3i06Q44DFBGlA4BDZsx:EulCJTHl42qw3c3btXS0N44JBn+dsx
- TLSH
  T168231A0037E8C12BF2BE4F78A9F252454A7AF6637A02D54D2CC441DB5623FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2