asyncrat | be4c33cc467ad94994efee077a29dcefe3dd2b727dd379ee8793af2de263d43a

Sharing

Copy URL Twitter E-mail

General

Target
be4c33cc467ad94994efee077a29dcefe3dd2b727dd379ee8793af2de263d43a
Size 45KB
Sample260905-jgcteswzcs
SHA256 be4c33cc467ad94994efee077a29dcefe3dd2b727dd379ee8793af2de263d43a
MD5 ff0200b00f9f7db00e5dfae3db9927e9
SHA1 837fa5b2b574623297301bc7a09612a43c18e22c
SHA512 5b3e6e41d62ad76f3539cde7527e9edaacd35dd374c25f4c150b720f07392dda5e12daf12657f1f7aa3b372a2455a53dbcbc27a1b74769ea571155d19d3f9526
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1/BzCQKx7PIm3jbkgX3iItdLgQi4DF2zEZarBDZW:cu6YepTPso2+o0mTbrXSSjFSKa9dUx
TLSH
T10C231A003BD8813BF2BE4FB46CF26145867AF6672603D5492CC451DB5723FC6CA526EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lonto.site:80
lonto.site:22
lonto.site:8080
lonto.site:8880
lonto.site:2052
lonto.site:2082
lonto.site:2086
lonto.site:2095
lonto.site:443
lonto.site:2053
lonto.site:2083
lonto.site:2087
lonto.site:2096
lonto.site:8443
www.lonto.site:80
www.lonto.site:22
www.lonto.site:8080
www.lonto.site:8880
www.lonto.site:2052
www.lonto.site:2082
www.lonto.site:2086
www.lonto.site:2095
www.lonto.site:443
www.lonto.site:2053
www.lonto.site:2083
www.lonto.site:2087
www.lonto.site:2096
www.lonto.site:8443
remote.lonto.site:80
remote.lonto.site:22
remote.lonto.site:8080
remote.lonto.site:8880
remote.lonto.site:2052
remote.lonto.site:2082
remote.lonto.site:2086
remote.lonto.site:2095
remote.lonto.site:443
remote.lonto.site:2053
remote.lonto.site:2083
remote.lonto.site:2087
remote.lonto.site:2096
remote.lonto.site:8443
clop.lonto.site:80
clop.lonto.site:22
clop.lonto.site:8080
clop.lonto.site:8880
clop.lonto.site:2052
clop.lonto.site:2082
clop.lonto.site:2086
clop.lonto.site:2095
clop.lonto.site:443
clop.lonto.site:2053
clop.lonto.site:2083
clop.lonto.site:2087
clop.lonto.site:2096
clop.lonto.site:8443
trisis.lonto.site:80
trisis.lonto.site:22
trisis.lonto.site:8080
trisis.lonto.site:8880
trisis.lonto.site:2052
trisis.lonto.site:2082
trisis.lonto.site:2086
trisis.lonto.site:2095
trisis.lonto.site:443
trisis.lonto.site:2053
trisis.lonto.site:2083
trisis.lonto.site:2087
trisis.lonto.site:2096
trisis.lonto.site:8443
shamoon.lonto.site:80
shamoon.lonto.site:22
shamoon.lonto.site:8080
shamoon.lonto.site:8880
shamoon.lonto.site:2052
shamoon.lonto.site:2082
shamoon.lonto.site:2086
shamoon.lonto.site:2095
shamoon.lonto.site:443
shamoon.lonto.site:2053
shamoon.lonto.site:2083
shamoon.lonto.site:2087
shamoon.lonto.site:2096
shamoon.lonto.site:8443

Mutex

gnfuRnwcjWeS

Attributes

delay
0
install
true
install_file
8sevg5wc.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  be4c33cc467ad94994efee077a29dcefe3dd2b727dd379ee8793af2de263d43a
- Size 45KB
- SHA256 be4c33cc467ad94994efee077a29dcefe3dd2b727dd379ee8793af2de263d43a
- MD5 ff0200b00f9f7db00e5dfae3db9927e9
- SHA1 837fa5b2b574623297301bc7a09612a43c18e22c
- SHA512 5b3e6e41d62ad76f3539cde7527e9edaacd35dd374c25f4c150b720f07392dda5e12daf12657f1f7aa3b372a2455a53dbcbc27a1b74769ea571155d19d3f9526
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1/BzCQKx7PIm3jbkgX3iItdLgQi4DF2zEZarBDZW:cu6YepTPso2+o0mTbrXSSjFSKa9dUx
- TLSH
  T10C231A003BD8813BF2BE4FB46CF26145867AF6672603D5492CC451DB5723FC6CA526EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2