asyncrat | f5577ebbc3a8599d7cc048a0c49be88bda48deaf749f01109821492a5c3d60af

Sharing

Copy URL Twitter E-mail

General

Target
f5577ebbc3a8599d7cc048a0c49be88bda48deaf749f01109821492a5c3d60af
Size 45KB
Sample260905-ktzdmahn7w
SHA256 f5577ebbc3a8599d7cc048a0c49be88bda48deaf749f01109821492a5c3d60af
MD5 3c666f6e8a59aec37e7fa77bb7baa1da
SHA1 55f9b20e3f77241b651e0886df8bf982826cd3ee
SHA512 b1dd25bb5ca5e39c89c48768ed7b9395839a6e270fee0ad3425817c2653c4e7d12bee83c94144a736ae6ee37c28f6dd523abbc6aaf2889cba8c9b704595c485f
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF63xq6YFoOPIUzjbdgU3izQe54E3Hc5XqBDZEx:MuLAZTnbg2Pkxo3U3bKUSzQe54yHvdEx
TLSH
T1F0232A003BE8812BF2BE4F78ADF26145467AF2636603D64D1CC451DB5623FC6DA426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

gainungvn.top:80
gainungvn.top:22
gainungvn.top:8080
gainungvn.top:8880
gainungvn.top:2052
gainungvn.top:2082
gainungvn.top:2086
gainungvn.top:2095
gainungvn.top:443
gainungvn.top:2053
gainungvn.top:2083
gainungvn.top:2087
gainungvn.top:2096
gainungvn.top:8443
www.gainungvn.top:80
www.gainungvn.top:22
www.gainungvn.top:8080
www.gainungvn.top:8880
www.gainungvn.top:2052
www.gainungvn.top:2082
www.gainungvn.top:2086
www.gainungvn.top:2095
www.gainungvn.top:443
www.gainungvn.top:2053
www.gainungvn.top:2083
www.gainungvn.top:2087
www.gainungvn.top:2096
www.gainungvn.top:8443
lokibot.gainungvn.top:80
lokibot.gainungvn.top:22
lokibot.gainungvn.top:8080
lokibot.gainungvn.top:8880
lokibot.gainungvn.top:2052
lokibot.gainungvn.top:2082
lokibot.gainungvn.top:2086
lokibot.gainungvn.top:2095
lokibot.gainungvn.top:443
lokibot.gainungvn.top:2053
lokibot.gainungvn.top:2083
lokibot.gainungvn.top:2087
lokibot.gainungvn.top:2096
lokibot.gainungvn.top:8443
cryptolocker.gainungvn.top:80
cryptolocker.gainungvn.top:22
cryptolocker.gainungvn.top:8080
cryptolocker.gainungvn.top:8880
cryptolocker.gainungvn.top:2052
cryptolocker.gainungvn.top:2082
cryptolocker.gainungvn.top:2086
cryptolocker.gainungvn.top:2095
cryptolocker.gainungvn.top:443
cryptolocker.gainungvn.top:2053
cryptolocker.gainungvn.top:2083
cryptolocker.gainungvn.top:2087
cryptolocker.gainungvn.top:2096
cryptolocker.gainungvn.top:8443
zbot.gainungvn.top:80
zbot.gainungvn.top:22
zbot.gainungvn.top:8080
zbot.gainungvn.top:8880
zbot.gainungvn.top:2052
zbot.gainungvn.top:2082
zbot.gainungvn.top:2086
zbot.gainungvn.top:2095
zbot.gainungvn.top:443
zbot.gainungvn.top:2053
zbot.gainungvn.top:2083
zbot.gainungvn.top:2087
zbot.gainungvn.top:2096
zbot.gainungvn.top:8443

Mutex

8EEeDr2eV6Ri

Attributes

delay
0
install
true
install_file
kkxil.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  f5577ebbc3a8599d7cc048a0c49be88bda48deaf749f01109821492a5c3d60af
- Size 45KB
- SHA256 f5577ebbc3a8599d7cc048a0c49be88bda48deaf749f01109821492a5c3d60af
- MD5 3c666f6e8a59aec37e7fa77bb7baa1da
- SHA1 55f9b20e3f77241b651e0886df8bf982826cd3ee
- SHA512 b1dd25bb5ca5e39c89c48768ed7b9395839a6e270fee0ad3425817c2653c4e7d12bee83c94144a736ae6ee37c28f6dd523abbc6aaf2889cba8c9b704595c485f
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF63xq6YFoOPIUzjbdgU3izQe54E3Hc5XqBDZEx:MuLAZTnbg2Pkxo3U3bKUSzQe54yHvdEx
- TLSH
  T1F0232A003BE8812BF2BE4F78ADF26145467AF2636603D64D1CC451DB5623FC6DA426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2