asyncrat | d09facb64782d094976a13e42c7736a3e2f6d937889966d8210309fbdcb74725

Sharing

Copy URL Twitter E-mail

General

Target
d09facb64782d094976a13e42c7736a3e2f6d937889966d8210309fbdcb74725
Size 45KB
Sample260905-knb15sch58
SHA256 d09facb64782d094976a13e42c7736a3e2f6d937889966d8210309fbdcb74725
MD5 e4e3e7f1a93640656c55094cd757e394
SHA1 3d3a30d6c523977dae9b803d9f69ad2721f4bdc9
SHA512 1749c7316ee735ae8e05fe8234bdd3255af28e01c78c2fceb6cde62f13fb19b6bddcb0a4f6214e3bb746219ec4ff27d720ef3e8d1c562fa9f1b31fb1399b55a1
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAUqyE0OFUwdexIkDPIpzjb4gX3iTPZi5+IQCkqsori3:kuSOpTPOP2EqNTwMp3bvXSTPZq+IQ3q2
TLSH
T17B233A0037E9812BF1BE4F78A9F25245867AE5736603D54A1CC451DB1B23FC68A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hentaivip.bot:80
hentaivip.bot:22
hentaivip.bot:8080
hentaivip.bot:8880
hentaivip.bot:2052
hentaivip.bot:2082
hentaivip.bot:2086
hentaivip.bot:2095
hentaivip.bot:443
hentaivip.bot:2053
hentaivip.bot:2083
hentaivip.bot:2087
hentaivip.bot:2096
hentaivip.bot:8443
www.hentaivip.bot:80
www.hentaivip.bot:22
www.hentaivip.bot:8080
www.hentaivip.bot:8880
www.hentaivip.bot:2052
www.hentaivip.bot:2082
www.hentaivip.bot:2086
www.hentaivip.bot:2095
www.hentaivip.bot:443
www.hentaivip.bot:2053
www.hentaivip.bot:2083
www.hentaivip.bot:2087
www.hentaivip.bot:2096
www.hentaivip.bot:8443
dridex.hentaivip.bot:80
dridex.hentaivip.bot:22
dridex.hentaivip.bot:8080
dridex.hentaivip.bot:8880
dridex.hentaivip.bot:2052
dridex.hentaivip.bot:2082
dridex.hentaivip.bot:2086
dridex.hentaivip.bot:2095
dridex.hentaivip.bot:443
dridex.hentaivip.bot:2053
dridex.hentaivip.bot:2083
dridex.hentaivip.bot:2087
dridex.hentaivip.bot:2096
dridex.hentaivip.bot:8443
mydoom.hentaivip.bot:80
mydoom.hentaivip.bot:22
mydoom.hentaivip.bot:8080
mydoom.hentaivip.bot:8880
mydoom.hentaivip.bot:2052
mydoom.hentaivip.bot:2082
mydoom.hentaivip.bot:2086
mydoom.hentaivip.bot:2095
mydoom.hentaivip.bot:443
mydoom.hentaivip.bot:2053
mydoom.hentaivip.bot:2083
mydoom.hentaivip.bot:2087
mydoom.hentaivip.bot:2096
mydoom.hentaivip.bot:8443
hacker.hentaivip.bot:80
hacker.hentaivip.bot:22
hacker.hentaivip.bot:8080
hacker.hentaivip.bot:8880
hacker.hentaivip.bot:2052
hacker.hentaivip.bot:2082
hacker.hentaivip.bot:2086
hacker.hentaivip.bot:2095
hacker.hentaivip.bot:443
hacker.hentaivip.bot:2053
hacker.hentaivip.bot:2083
hacker.hentaivip.bot:2087
hacker.hentaivip.bot:2096
hacker.hentaivip.bot:8443
formbook.hentaivip.bot:80
formbook.hentaivip.bot:22
formbook.hentaivip.bot:8080
formbook.hentaivip.bot:8880
formbook.hentaivip.bot:2052
formbook.hentaivip.bot:2082
formbook.hentaivip.bot:2086
formbook.hentaivip.bot:2095
formbook.hentaivip.bot:443
formbook.hentaivip.bot:2053
formbook.hentaivip.bot:2083
formbook.hentaivip.bot:2087
formbook.hentaivip.bot:2096
formbook.hentaivip.bot:8443

Mutex

fwUrX3rRuF7e

Attributes

delay
0
install
true
install_file
m4b1.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  d09facb64782d094976a13e42c7736a3e2f6d937889966d8210309fbdcb74725
- Size 45KB
- SHA256 d09facb64782d094976a13e42c7736a3e2f6d937889966d8210309fbdcb74725
- MD5 e4e3e7f1a93640656c55094cd757e394
- SHA1 3d3a30d6c523977dae9b803d9f69ad2721f4bdc9
- SHA512 1749c7316ee735ae8e05fe8234bdd3255af28e01c78c2fceb6cde62f13fb19b6bddcb0a4f6214e3bb746219ec4ff27d720ef3e8d1c562fa9f1b31fb1399b55a1
- SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAUqyE0OFUwdexIkDPIpzjb4gX3iTPZi5+IQCkqsori3:kuSOpTPOP2EqNTwMp3bvXSTPZq+IQ3q2
- TLSH
  T17B233A0037E9812BF1BE4F78A9F25245867AE5736603D54A1CC451DB1B23FC68A43AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2