asyncrat | baa6c859edcacb8adc6214c705ef4511d882a006d396c98e0421ea541c075342

Sharing

Copy URL Twitter E-mail

General

Target
baa6c859edcacb8adc6214c705ef4511d882a006d396c98e0421ea541c075342
Size 45KB
Sample260907-pff3cawflh
SHA256 baa6c859edcacb8adc6214c705ef4511d882a006d396c98e0421ea541c075342
MD5 8194857efed334ce1477cc3d1645cf9e
SHA1 3fd8ca80772ab9b627ff5eacbfc71db9f829c839
SHA512 231a57b2db27982ab884fc0e78f8ebf2e576a31af03e12798088c30a94535e7d40e580af4832aaecdcb4af31974fcef8ea965b4c7aa0cc494a420c46f848e078
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXKGoibbb6tN8/nPI6DzjbtgX3ieU0pgXIb0Auu:ku40ZTXEb2TeDqtNKA6D3b6XSeUcgXsJ
TLSH
T12D231A003BE8C12BF2BF4F7869F26145867AE6633603D94E1CC4519B5613FC68A52AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

gainungvn.top:80
gainungvn.top:22
gainungvn.top:8080
gainungvn.top:8880
gainungvn.top:2052
gainungvn.top:2082
gainungvn.top:2086
gainungvn.top:2095
gainungvn.top:443
gainungvn.top:2053
gainungvn.top:2083
gainungvn.top:2087
gainungvn.top:2096
gainungvn.top:8443
www.gainungvn.top:80
www.gainungvn.top:22
www.gainungvn.top:8080
www.gainungvn.top:8880
www.gainungvn.top:2052
www.gainungvn.top:2082
www.gainungvn.top:2086
www.gainungvn.top:2095
www.gainungvn.top:443
www.gainungvn.top:2053
www.gainungvn.top:2083
www.gainungvn.top:2087
www.gainungvn.top:2096
www.gainungvn.top:8443
malware.gainungvn.top:80
malware.gainungvn.top:22
malware.gainungvn.top:8080
malware.gainungvn.top:8880
malware.gainungvn.top:2052
malware.gainungvn.top:2082
malware.gainungvn.top:2086
malware.gainungvn.top:2095
malware.gainungvn.top:443
malware.gainungvn.top:2053
malware.gainungvn.top:2083
malware.gainungvn.top:2087
malware.gainungvn.top:2096
malware.gainungvn.top:8443
ursnif.gainungvn.top:80
ursnif.gainungvn.top:22
ursnif.gainungvn.top:8080
ursnif.gainungvn.top:8880
ursnif.gainungvn.top:2052
ursnif.gainungvn.top:2082
ursnif.gainungvn.top:2086
ursnif.gainungvn.top:2095
ursnif.gainungvn.top:443
ursnif.gainungvn.top:2053
ursnif.gainungvn.top:2083
ursnif.gainungvn.top:2087
ursnif.gainungvn.top:2096
ursnif.gainungvn.top:8443
iloveyou.gainungvn.top:80
iloveyou.gainungvn.top:22
iloveyou.gainungvn.top:8080
iloveyou.gainungvn.top:8880
iloveyou.gainungvn.top:2052
iloveyou.gainungvn.top:2082
iloveyou.gainungvn.top:2086
iloveyou.gainungvn.top:2095
iloveyou.gainungvn.top:443
iloveyou.gainungvn.top:2053
iloveyou.gainungvn.top:2083
iloveyou.gainungvn.top:2087
iloveyou.gainungvn.top:2096
iloveyou.gainungvn.top:8443
shamoon.gainungvn.top:80
shamoon.gainungvn.top:22
shamoon.gainungvn.top:8080
shamoon.gainungvn.top:8880
shamoon.gainungvn.top:2052
shamoon.gainungvn.top:2082
shamoon.gainungvn.top:2086
shamoon.gainungvn.top:2095
shamoon.gainungvn.top:443
shamoon.gainungvn.top:2053
shamoon.gainungvn.top:2083
shamoon.gainungvn.top:2087
shamoon.gainungvn.top:2096
shamoon.gainungvn.top:8443

Mutex

GbLLkiRjFa6L

Attributes

delay
0
install
true
install_file
ikkww.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  baa6c859edcacb8adc6214c705ef4511d882a006d396c98e0421ea541c075342
- Size 45KB
- SHA256 baa6c859edcacb8adc6214c705ef4511d882a006d396c98e0421ea541c075342
- MD5 8194857efed334ce1477cc3d1645cf9e
- SHA1 3fd8ca80772ab9b627ff5eacbfc71db9f829c839
- SHA512 231a57b2db27982ab884fc0e78f8ebf2e576a31af03e12798088c30a94535e7d40e580af4832aaecdcb4af31974fcef8ea965b4c7aa0cc494a420c46f848e078
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXKGoibbb6tN8/nPI6DzjbtgX3ieU0pgXIb0Auu:ku40ZTXEb2TeDqtNKA6D3b6XSeUcgXsJ
- TLSH
  T12D231A003BE8C12BF2BF4F7869F26145867AE6633603D94E1CC4519B5613FC68A52AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2