asyncrat | deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e

Sharing

Copy URL Twitter E-mail

General

Target
deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e
Size 45KB
Sample260905-jpbakacf66
SHA256 deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e
MD5 81193702e378bf8ca9ab5ce42b4a5e36
SHA1 29bc6c1cce786597e3e84f025c9f0833690ce53f
SHA512 c798b01af02e2f9473b0c1e5c8e8da6fc76893590a4ff8afe06f9fe1200616f415c3a97b7023d7d9eb482ffe72beb87e9dadfda70e6c37fae4c67e316919eccb
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPIQWjbhgX3iM2qdQZqkW9GYIkCBDZsx:EulCJTHl42sU3QabOXSM2wqqkYnqdsx
TLSH
T19C232B0037E8C127F2BE4B7859F26245867AF2673603D69E1CC4419B5723FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

gainungvn.top:80
gainungvn.top:22
gainungvn.top:8080
gainungvn.top:8880
gainungvn.top:2052
gainungvn.top:2082
gainungvn.top:2086
gainungvn.top:2095
gainungvn.top:443
gainungvn.top:2053
gainungvn.top:2083
gainungvn.top:2087
gainungvn.top:2096
gainungvn.top:8443
www.gainungvn.top:80
www.gainungvn.top:22
www.gainungvn.top:8080
www.gainungvn.top:8880
www.gainungvn.top:2052
www.gainungvn.top:2082
www.gainungvn.top:2086
www.gainungvn.top:2095
www.gainungvn.top:443
www.gainungvn.top:2053
www.gainungvn.top:2083
www.gainungvn.top:2087
www.gainungvn.top:2096
www.gainungvn.top:8443
blaster.gainungvn.top:80
blaster.gainungvn.top:22
blaster.gainungvn.top:8080
blaster.gainungvn.top:8880
blaster.gainungvn.top:2052
blaster.gainungvn.top:2082
blaster.gainungvn.top:2086
blaster.gainungvn.top:2095
blaster.gainungvn.top:443
blaster.gainungvn.top:2053
blaster.gainungvn.top:2083
blaster.gainungvn.top:2087
blaster.gainungvn.top:2096
blaster.gainungvn.top:8443
qbot.gainungvn.top:80
qbot.gainungvn.top:22
qbot.gainungvn.top:8080
qbot.gainungvn.top:8880
qbot.gainungvn.top:2052
qbot.gainungvn.top:2082
qbot.gainungvn.top:2086
qbot.gainungvn.top:2095
qbot.gainungvn.top:443
qbot.gainungvn.top:2053
qbot.gainungvn.top:2083
qbot.gainungvn.top:2087
qbot.gainungvn.top:2096
qbot.gainungvn.top:8443
ryuk.gainungvn.top:80
ryuk.gainungvn.top:22
ryuk.gainungvn.top:8080
ryuk.gainungvn.top:8880
ryuk.gainungvn.top:2052
ryuk.gainungvn.top:2082
ryuk.gainungvn.top:2086
ryuk.gainungvn.top:2095
ryuk.gainungvn.top:443
ryuk.gainungvn.top:2053
ryuk.gainungvn.top:2083
ryuk.gainungvn.top:2087
ryuk.gainungvn.top:2096
ryuk.gainungvn.top:8443
clop.gainungvn.top:80
clop.gainungvn.top:22
clop.gainungvn.top:8080
clop.gainungvn.top:8880
clop.gainungvn.top:2052
clop.gainungvn.top:2082
clop.gainungvn.top:2086
clop.gainungvn.top:2095
clop.gainungvn.top:443
clop.gainungvn.top:2053
clop.gainungvn.top:2083
clop.gainungvn.top:2087
clop.gainungvn.top:2096
clop.gainungvn.top:8443

Mutex

33dr4YCrVehG

Attributes

delay
0
install
true
install_file
m8eh9b.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e
- Size 45KB
- SHA256 deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e
- MD5 81193702e378bf8ca9ab5ce42b4a5e36
- SHA1 29bc6c1cce786597e3e84f025c9f0833690ce53f
- SHA512 c798b01af02e2f9473b0c1e5c8e8da6fc76893590a4ff8afe06f9fe1200616f415c3a97b7023d7d9eb482ffe72beb87e9dadfda70e6c37fae4c67e316919eccb
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPIQWjbhgX3iM2qdQZqkW9GYIkCBDZsx:EulCJTHl42sU3QabOXSM2wqqkYnqdsx
- TLSH
  T19C232B0037E8C127F2BE4B7859F26245867AF2673603D69E1CC4419B5723FC69A426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2