asyncrat | c744de5b00629343fa8155cfbbdb20217469da42d8f7a8191517384b632804a3

Sharing

Copy URL Twitter E-mail

General

Target
c744de5b00629343fa8155cfbbdb20217469da42d8f7a8191517384b632804a3
Size 45KB
Sample260907-pfmj5agg59
SHA256 c744de5b00629343fa8155cfbbdb20217469da42d8f7a8191517384b632804a3
MD5 b1178c94936244a6bb34cd62ccb7c41a
SHA1 2f3791e46789b5b4b333feebc545cb81d7516993
SHA512 e2f3ae0f61902fb85168d78a6bcfddc085386a6039caaa8ecd10c67bed59ca877f57894308e356bc78502652593e907d6cea4a6d8f3f32c28eee94d72ff2ab8d
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9UHO9YjoHPICYzjbygX3igaVouyNbYsBDZsx:EulCJTHl42A6kgCY3b1XSDVoFNbzdsx
TLSH
T1E3231A003BE9C23BF2BE4B74A9F26145867AF6637503D58D1CC442CB5623FC69A426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xxxhot.name:80
xxxhot.name:22
xxxhot.name:8080
xxxhot.name:8880
xxxhot.name:2052
xxxhot.name:2082
xxxhot.name:2086
xxxhot.name:2095
xxxhot.name:443
xxxhot.name:2053
xxxhot.name:2083
xxxhot.name:2087
xxxhot.name:2096
xxxhot.name:8443
www.xxxhot.name:80
www.xxxhot.name:22
www.xxxhot.name:8080
www.xxxhot.name:8880
www.xxxhot.name:2052
www.xxxhot.name:2082
www.xxxhot.name:2086
www.xxxhot.name:2095
www.xxxhot.name:443
www.xxxhot.name:2053
www.xxxhot.name:2083
www.xxxhot.name:2087
www.xxxhot.name:2096
www.xxxhot.name:8443
gozi.xxxhot.name:80
gozi.xxxhot.name:22
gozi.xxxhot.name:8080
gozi.xxxhot.name:8880
gozi.xxxhot.name:2052
gozi.xxxhot.name:2082
gozi.xxxhot.name:2086
gozi.xxxhot.name:2095
gozi.xxxhot.name:443
gozi.xxxhot.name:2053
gozi.xxxhot.name:2083
gozi.xxxhot.name:2087
gozi.xxxhot.name:2096
gozi.xxxhot.name:8443
triton.xxxhot.name:80
triton.xxxhot.name:22
triton.xxxhot.name:8080
triton.xxxhot.name:8880
triton.xxxhot.name:2052
triton.xxxhot.name:2082
triton.xxxhot.name:2086
triton.xxxhot.name:2095
triton.xxxhot.name:443
triton.xxxhot.name:2053
triton.xxxhot.name:2083
triton.xxxhot.name:2087
triton.xxxhot.name:2096
triton.xxxhot.name:8443
invasive.xxxhot.name:80
invasive.xxxhot.name:22
invasive.xxxhot.name:8080
invasive.xxxhot.name:8880
invasive.xxxhot.name:2052
invasive.xxxhot.name:2082
invasive.xxxhot.name:2086
invasive.xxxhot.name:2095
invasive.xxxhot.name:443
invasive.xxxhot.name:2053
invasive.xxxhot.name:2083
invasive.xxxhot.name:2087
invasive.xxxhot.name:2096
invasive.xxxhot.name:8443
hermeticwiper.xxxhot.name:80
hermeticwiper.xxxhot.name:22
hermeticwiper.xxxhot.name:8080
hermeticwiper.xxxhot.name:8880
hermeticwiper.xxxhot.name:2052
hermeticwiper.xxxhot.name:2082
hermeticwiper.xxxhot.name:2086
hermeticwiper.xxxhot.name:2095
hermeticwiper.xxxhot.name:443
hermeticwiper.xxxhot.name:2053
hermeticwiper.xxxhot.name:2083
hermeticwiper.xxxhot.name:2087
hermeticwiper.xxxhot.name:2096
hermeticwiper.xxxhot.name:8443

Mutex

nRgxtd2hESoY

Attributes

delay
0
install
true
install_file
95j0tz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c744de5b00629343fa8155cfbbdb20217469da42d8f7a8191517384b632804a3
- Size 45KB
- SHA256 c744de5b00629343fa8155cfbbdb20217469da42d8f7a8191517384b632804a3
- MD5 b1178c94936244a6bb34cd62ccb7c41a
- SHA1 2f3791e46789b5b4b333feebc545cb81d7516993
- SHA512 e2f3ae0f61902fb85168d78a6bcfddc085386a6039caaa8ecd10c67bed59ca877f57894308e356bc78502652593e907d6cea4a6d8f3f32c28eee94d72ff2ab8d
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9UHO9YjoHPICYzjbygX3igaVouyNbYsBDZsx:EulCJTHl42A6kgCY3b1XSDVoFNbzdsx
- TLSH
  T1E3231A003BE9C23BF2BE4B74A9F26145867AF6637503D58D1CC442CB5623FC69A426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2