asyncrat | d76504878159d357fc8d3c2c4d4c8f2b475722fcad0ff6ec57f1b5b0eb8c8f83

Sharing

Copy URL Twitter E-mail

General

Target
d76504878159d357fc8d3c2c4d4c8f2b475722fcad0ff6ec57f1b5b0eb8c8f83
Size 45KB
Sample260905-lt6ndayxas
SHA256 d76504878159d357fc8d3c2c4d4c8f2b475722fcad0ff6ec57f1b5b0eb8c8f83
MD5 f48d996d2f82459b0eab21a6c6589ea5
SHA1 adf0d12ff2abf600042fb8ce45c08d72cc35d5ab
SHA512 f941b586ba73825d78b3ba52cbbd16895cda8ed1686a903daa23885b55404ba8602f9d2f3000fcdaa7432e5a53115c42b5249cf88f8f2405a9b882cfc42f3cda
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvzdAAyPMlL8TfPIMWzjbGgX34RTBySP3K09RyzlhvU:MuLAZTnbg26lvlL+4MW3bZXoRsSvpKZU
TLSH
T181232B003BE8C12BF2BE4FB899F26145867AF5633603D64E1CC4519B5B23FC696426F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hovsex.top:80
hovsex.top:22
hovsex.top:8080
hovsex.top:8880
hovsex.top:2052
hovsex.top:2082
hovsex.top:2086
hovsex.top:2095
hovsex.top:443
hovsex.top:2053
hovsex.top:2083
hovsex.top:2087
hovsex.top:2096
hovsex.top:8443
www.hovsex.top:80
www.hovsex.top:22
www.hovsex.top:8080
www.hovsex.top:8880
www.hovsex.top:2052
www.hovsex.top:2082
www.hovsex.top:2086
www.hovsex.top:2095
www.hovsex.top:443
www.hovsex.top:2053
www.hovsex.top:2083
www.hovsex.top:2087
www.hovsex.top:2096
www.hovsex.top:8443
sasser.hovsex.top:80
sasser.hovsex.top:22
sasser.hovsex.top:8080
sasser.hovsex.top:8880
sasser.hovsex.top:2052
sasser.hovsex.top:2082
sasser.hovsex.top:2086
sasser.hovsex.top:2095
sasser.hovsex.top:443
sasser.hovsex.top:2053
sasser.hovsex.top:2083
sasser.hovsex.top:2087
sasser.hovsex.top:2096
sasser.hovsex.top:8443
hacker.hovsex.top:80
hacker.hovsex.top:22
hacker.hovsex.top:8080
hacker.hovsex.top:8880
hacker.hovsex.top:2052
hacker.hovsex.top:2082
hacker.hovsex.top:2086
hacker.hovsex.top:2095
hacker.hovsex.top:443
hacker.hovsex.top:2053
hacker.hovsex.top:2083
hacker.hovsex.top:2087
hacker.hovsex.top:2096
hacker.hovsex.top:8443
mirai.hovsex.top:80
mirai.hovsex.top:22
mirai.hovsex.top:8080
mirai.hovsex.top:8880
mirai.hovsex.top:2052
mirai.hovsex.top:2082
mirai.hovsex.top:2086
mirai.hovsex.top:2095
mirai.hovsex.top:443
mirai.hovsex.top:2053
mirai.hovsex.top:2083
mirai.hovsex.top:2087
mirai.hovsex.top:2096
mirai.hovsex.top:8443
triton.hovsex.top:80
triton.hovsex.top:22
triton.hovsex.top:8080
triton.hovsex.top:8880
triton.hovsex.top:2052
triton.hovsex.top:2082
triton.hovsex.top:2086
triton.hovsex.top:2095
triton.hovsex.top:443
triton.hovsex.top:2053
triton.hovsex.top:2083
triton.hovsex.top:2087
triton.hovsex.top:2096
triton.hovsex.top:8443

Mutex

TJZTFICLBNhf

Attributes

delay
0
install
true
install_file
kwy6s.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  d76504878159d357fc8d3c2c4d4c8f2b475722fcad0ff6ec57f1b5b0eb8c8f83
- Size 45KB
- SHA256 d76504878159d357fc8d3c2c4d4c8f2b475722fcad0ff6ec57f1b5b0eb8c8f83
- MD5 f48d996d2f82459b0eab21a6c6589ea5
- SHA1 adf0d12ff2abf600042fb8ce45c08d72cc35d5ab
- SHA512 f941b586ba73825d78b3ba52cbbd16895cda8ed1686a903daa23885b55404ba8602f9d2f3000fcdaa7432e5a53115c42b5249cf88f8f2405a9b882cfc42f3cda
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvzdAAyPMlL8TfPIMWzjbGgX34RTBySP3K09RyzlhvU:MuLAZTnbg26lvlL+4MW3bZXoRsSvpKZU
- TLSH
  T181232B003BE8C12BF2BE4FB899F26145867AF5633603D64E1CC4519B5B23FC696426F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2