asyncrat | 3c5a85fc2eedbc945c58aea74b8095930f41606c615f952f6b401822adad1f7e

Sharing

Copy URL Twitter E-mail

General

Target
3c5a85fc2eedbc945c58aea74b8095930f41606c615f952f6b401822adad1f7e
Size 45KB
Sample260908-bpm1csbj5s
SHA256 3c5a85fc2eedbc945c58aea74b8095930f41606c615f952f6b401822adad1f7e
MD5 d72793aa08a595fee2a42048bab582a6
SHA1 9710b5dff8a8176a516be0c6fa1596be02529a72
SHA512 5368372443b4e2dd98a5aaf59ee30c0f67ca8e1401b6fc64cd1225e206028de9fc6b669c45ac25c10f1be7bc0f49ebd05524a54901978c11ed5898d927cbed29
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9q9Yq3q3hOPI2zjbAgX3iiUb2IljKFDuQBDZ8x:0uPrpT/qY2HaCq323bnXSDR0d8x
TLSH
T14F233A003BE9C12BF2BF5F7898F26145467AF2633603D64A1CC452971723BC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xxxhot.name:80
xxxhot.name:22
xxxhot.name:8080
xxxhot.name:8880
xxxhot.name:2052
xxxhot.name:2082
xxxhot.name:2086
xxxhot.name:2095
xxxhot.name:443
xxxhot.name:2053
xxxhot.name:2083
xxxhot.name:2087
xxxhot.name:2096
xxxhot.name:8443
www.xxxhot.name:80
www.xxxhot.name:22
www.xxxhot.name:8080
www.xxxhot.name:8880
www.xxxhot.name:2052
www.xxxhot.name:2082
www.xxxhot.name:2086
www.xxxhot.name:2095
www.xxxhot.name:443
www.xxxhot.name:2053
www.xxxhot.name:2083
www.xxxhot.name:2087
www.xxxhot.name:2096
www.xxxhot.name:8443
clop.xxxhot.name:80
clop.xxxhot.name:22
clop.xxxhot.name:8080
clop.xxxhot.name:8880
clop.xxxhot.name:2052
clop.xxxhot.name:2082
clop.xxxhot.name:2086
clop.xxxhot.name:2095
clop.xxxhot.name:443
clop.xxxhot.name:2053
clop.xxxhot.name:2083
clop.xxxhot.name:2087
clop.xxxhot.name:2096
clop.xxxhot.name:8443
melissa.xxxhot.name:80
melissa.xxxhot.name:22
melissa.xxxhot.name:8080
melissa.xxxhot.name:8880
melissa.xxxhot.name:2052
melissa.xxxhot.name:2082
melissa.xxxhot.name:2086
melissa.xxxhot.name:2095
melissa.xxxhot.name:443
melissa.xxxhot.name:2053
melissa.xxxhot.name:2083
melissa.xxxhot.name:2087
melissa.xxxhot.name:2096
melissa.xxxhot.name:8443
fakeupdates.xxxhot.name:80
fakeupdates.xxxhot.name:22
fakeupdates.xxxhot.name:8080
fakeupdates.xxxhot.name:8880
fakeupdates.xxxhot.name:2052
fakeupdates.xxxhot.name:2082
fakeupdates.xxxhot.name:2086
fakeupdates.xxxhot.name:2095
fakeupdates.xxxhot.name:443
fakeupdates.xxxhot.name:2053
fakeupdates.xxxhot.name:2083
fakeupdates.xxxhot.name:2087
fakeupdates.xxxhot.name:2096
fakeupdates.xxxhot.name:8443

Mutex

yB83ivCf7EvF

Attributes

delay
0
install
true
install_file
cjzhenf.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  3c5a85fc2eedbc945c58aea74b8095930f41606c615f952f6b401822adad1f7e
- Size 45KB
- SHA256 3c5a85fc2eedbc945c58aea74b8095930f41606c615f952f6b401822adad1f7e
- MD5 d72793aa08a595fee2a42048bab582a6
- SHA1 9710b5dff8a8176a516be0c6fa1596be02529a72
- SHA512 5368372443b4e2dd98a5aaf59ee30c0f67ca8e1401b6fc64cd1225e206028de9fc6b669c45ac25c10f1be7bc0f49ebd05524a54901978c11ed5898d927cbed29
- SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9q9Yq3q3hOPI2zjbAgX3iiUb2IljKFDuQBDZ8x:0uPrpT/qY2HaCq323bnXSDR0d8x
- TLSH
  T14F233A003BE9C12BF2BF5F7898F26145467AF2633603D64A1CC452971723BC69A42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2