asyncrat | 87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc

Sharing

Copy URL Twitter E-mail

General

Target
87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc
Size 45KB
Sample260905-ns69matdnb
SHA256 87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc
MD5 7f208d3e8de6f14d22fd8f163e78bf04
SHA1 4b6e581bfcbadc11805204fc87372e3ac465fc94
SHA512 d122838825a8980a85736450fe73b2280c2a02aabe07f14bf255e1a845d6a5af77a52e6b4f1b5a932cda81a209d6d96540d6d5f75d028f2701923a2d5b454bd2
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/NYssPJZOPIczzjbVgXkiFv1L8V8QQ0Qag9BDZsx:EulCJTHl42eHIf3cz3byXhLL8JQ0bgTc
TLSH
T14B231B0037E8822BF2BE4F749CF26145867AF6673603E58A1CC451DB5613FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

gainungvn.top:80
gainungvn.top:22
gainungvn.top:8080
gainungvn.top:8880
gainungvn.top:2052
gainungvn.top:2082
gainungvn.top:2086
gainungvn.top:2095
gainungvn.top:443
gainungvn.top:2053
gainungvn.top:2083
gainungvn.top:2087
gainungvn.top:2096
gainungvn.top:8443
www.gainungvn.top:80
www.gainungvn.top:22
www.gainungvn.top:8080
www.gainungvn.top:8880
www.gainungvn.top:2052
www.gainungvn.top:2082
www.gainungvn.top:2086
www.gainungvn.top:2095
www.gainungvn.top:443
www.gainungvn.top:2053
www.gainungvn.top:2083
www.gainungvn.top:2087
www.gainungvn.top:2096
www.gainungvn.top:8443
remcos.gainungvn.top:80
remcos.gainungvn.top:22
remcos.gainungvn.top:8080
remcos.gainungvn.top:8880
remcos.gainungvn.top:2052
remcos.gainungvn.top:2082
remcos.gainungvn.top:2086
remcos.gainungvn.top:2095
remcos.gainungvn.top:443
remcos.gainungvn.top:2053
remcos.gainungvn.top:2083
remcos.gainungvn.top:2087
remcos.gainungvn.top:2096
remcos.gainungvn.top:8443
codered.gainungvn.top:80
codered.gainungvn.top:22
codered.gainungvn.top:8080
codered.gainungvn.top:8880
codered.gainungvn.top:2052
codered.gainungvn.top:2082
codered.gainungvn.top:2086
codered.gainungvn.top:2095
codered.gainungvn.top:443
codered.gainungvn.top:2053
codered.gainungvn.top:2083
codered.gainungvn.top:2087
codered.gainungvn.top:2096
codered.gainungvn.top:8443
trickbot.gainungvn.top:80
trickbot.gainungvn.top:22
trickbot.gainungvn.top:8080
trickbot.gainungvn.top:8880
trickbot.gainungvn.top:2052
trickbot.gainungvn.top:2082
trickbot.gainungvn.top:2086
trickbot.gainungvn.top:2095
trickbot.gainungvn.top:443
trickbot.gainungvn.top:2053
trickbot.gainungvn.top:2083
trickbot.gainungvn.top:2087
trickbot.gainungvn.top:2096
trickbot.gainungvn.top:8443

Mutex

3rBCXdDF9WDF

Attributes

delay
0
install
true
install_file
x099bq.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc
- Size 45KB
- SHA256 87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc
- MD5 7f208d3e8de6f14d22fd8f163e78bf04
- SHA1 4b6e581bfcbadc11805204fc87372e3ac465fc94
- SHA512 d122838825a8980a85736450fe73b2280c2a02aabe07f14bf255e1a845d6a5af77a52e6b4f1b5a932cda81a209d6d96540d6d5f75d028f2701923a2d5b454bd2
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/NYssPJZOPIczzjbVgXkiFv1L8V8QQ0Qag9BDZsx:EulCJTHl42eHIf3cz3byXhLL8JQ0bgTc
- TLSH
  T14B231B0037E8822BF2BE4F749CF26145867AF6673603E58A1CC451DB5613FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2