asyncrat | cc0ea86ea31d9e81dbf17a2aeb82a58b47260c1ced2b563e195cfc930234aa1e

Sharing

Copy URL Twitter E-mail

General

Target
cc0ea86ea31d9e81dbf17a2aeb82a58b47260c1ced2b563e195cfc930234aa1e
Size 45KB
Sample260905-mvzf5asfph
SHA256 cc0ea86ea31d9e81dbf17a2aeb82a58b47260c1ced2b563e195cfc930234aa1e
MD5 5263302d7b5f5baff84c71b0453f635e
SHA1 f0f6826aefee26fe757ca3221c9eefd6a6dc2739
SHA512 eae5079d3cd3636e5ad0f81db66855e6e55f71e69e9113eae5414f68077448eeb6cbba26c121bb4b4454d1afac465fb888a594f5a0df3161bc9f532d0fc026c6
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF/3xE6YFoOPIGKzjbAg73iP90YlKCNmFb5ZXE+oBDg:cu7e5TH2A2CKxo3GK3bn7SVRlMrLOdUx
TLSH
T15C232A003BE8822BF2BE4F7899F26145867AF6B36603D64D1CC451DB5723BC686426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hentaivip.bot:80
hentaivip.bot:22
hentaivip.bot:8080
hentaivip.bot:8880
hentaivip.bot:2052
hentaivip.bot:2082
hentaivip.bot:2086
hentaivip.bot:2095
hentaivip.bot:443
hentaivip.bot:2053
hentaivip.bot:2083
hentaivip.bot:2087
hentaivip.bot:2096
hentaivip.bot:8443
www.hentaivip.bot:80
www.hentaivip.bot:22
www.hentaivip.bot:8080
www.hentaivip.bot:8880
www.hentaivip.bot:2052
www.hentaivip.bot:2082
www.hentaivip.bot:2086
www.hentaivip.bot:2095
www.hentaivip.bot:443
www.hentaivip.bot:2053
www.hentaivip.bot:2083
www.hentaivip.bot:2087
www.hentaivip.bot:2096
www.hentaivip.bot:8443
darkside.hentaivip.bot:80
darkside.hentaivip.bot:22
darkside.hentaivip.bot:8080
darkside.hentaivip.bot:8880
darkside.hentaivip.bot:2052
darkside.hentaivip.bot:2082
darkside.hentaivip.bot:2086
darkside.hentaivip.bot:2095
darkside.hentaivip.bot:443
darkside.hentaivip.bot:2053
darkside.hentaivip.bot:2083
darkside.hentaivip.bot:2087
darkside.hentaivip.bot:2096
darkside.hentaivip.bot:8443
ryuk.hentaivip.bot:80
ryuk.hentaivip.bot:22
ryuk.hentaivip.bot:8080
ryuk.hentaivip.bot:8880
ryuk.hentaivip.bot:2052
ryuk.hentaivip.bot:2082
ryuk.hentaivip.bot:2086
ryuk.hentaivip.bot:2095
ryuk.hentaivip.bot:443
ryuk.hentaivip.bot:2053
ryuk.hentaivip.bot:2083
ryuk.hentaivip.bot:2087
ryuk.hentaivip.bot:2096
ryuk.hentaivip.bot:8443
malware.hentaivip.bot:80
malware.hentaivip.bot:22
malware.hentaivip.bot:8080
malware.hentaivip.bot:8880
malware.hentaivip.bot:2052
malware.hentaivip.bot:2082
malware.hentaivip.bot:2086
malware.hentaivip.bot:2095
malware.hentaivip.bot:443
malware.hentaivip.bot:2053
malware.hentaivip.bot:2083
malware.hentaivip.bot:2087
malware.hentaivip.bot:2096
malware.hentaivip.bot:8443

Mutex

c6IqKM1mhxfq

Attributes

delay
0
install
true
install_file
niell.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  cc0ea86ea31d9e81dbf17a2aeb82a58b47260c1ced2b563e195cfc930234aa1e
- Size 45KB
- SHA256 cc0ea86ea31d9e81dbf17a2aeb82a58b47260c1ced2b563e195cfc930234aa1e
- MD5 5263302d7b5f5baff84c71b0453f635e
- SHA1 f0f6826aefee26fe757ca3221c9eefd6a6dc2739
- SHA512 eae5079d3cd3636e5ad0f81db66855e6e55f71e69e9113eae5414f68077448eeb6cbba26c121bb4b4454d1afac465fb888a594f5a0df3161bc9f532d0fc026c6
- SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF/3xE6YFoOPIGKzjbAg73iP90YlKCNmFb5ZXE+oBDg:cu7e5TH2A2CKxo3GK3bn7SVRlMrLOdUx
- TLSH
  T15C232A003BE8822BF2BE4F7899F26145867AF6B36603D64D1CC451DB5723BC686426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2