asyncrat | 47f3df5f93353fd987f9903d2d030d10cae10a4c74a799ef70ab48fa47c63f07

Sharing

Copy URL Twitter E-mail

General

Target
47f3df5f93353fd987f9903d2d030d10cae10a4c74a799ef70ab48fa47c63f07
Size 45KB
Sample260918-rffspafh78
SHA256 47f3df5f93353fd987f9903d2d030d10cae10a4c74a799ef70ab48fa47c63f07
MD5 8a833b4ae18d134dcd131d52bc170e15
SHA1 865166679d24021c7560719c6544507fe6e8b21a
SHA512 8194eecbcf3b22928e21276bfed01fdb0cbd42475de527f3bc941967ce240660ec7558c8b5aaf9cfae14b138aca859ec561b1d58a057ce8bf7ab7516904afe43
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEa+PIvEjbZgX3ibYuGm+ZWXBDZMx:ku40ZTXEb2C4EaHvEb2XSbT8WRdMx
TLSH
T197233B003BE8C12BF2BE5F7898F26145867AF6637603D54D2CC4119B5613FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

motphimchilll.dev:80
motphimchilll.dev:22
motphimchilll.dev:8080
motphimchilll.dev:8880
motphimchilll.dev:2052
motphimchilll.dev:2082
motphimchilll.dev:2086
motphimchilll.dev:2095
motphimchilll.dev:443
motphimchilll.dev:2053
motphimchilll.dev:2083
motphimchilll.dev:2087
motphimchilll.dev:2096
motphimchilll.dev:8443
www.motphimchilll.dev:80
www.motphimchilll.dev:22
www.motphimchilll.dev:8080
www.motphimchilll.dev:8880
www.motphimchilll.dev:2052
www.motphimchilll.dev:2082
www.motphimchilll.dev:2086
www.motphimchilll.dev:2095
www.motphimchilll.dev:443
www.motphimchilll.dev:2053
www.motphimchilll.dev:2083
www.motphimchilll.dev:2087
www.motphimchilll.dev:2096
www.motphimchilll.dev:8443
zbot.motphimchilll.dev:80
zbot.motphimchilll.dev:22
zbot.motphimchilll.dev:8080
zbot.motphimchilll.dev:8880
zbot.motphimchilll.dev:2052
zbot.motphimchilll.dev:2082
zbot.motphimchilll.dev:2086
zbot.motphimchilll.dev:2095
zbot.motphimchilll.dev:443
zbot.motphimchilll.dev:2053
zbot.motphimchilll.dev:2083
zbot.motphimchilll.dev:2087
zbot.motphimchilll.dev:2096
zbot.motphimchilll.dev:8443
melissa.motphimchilll.dev:80
melissa.motphimchilll.dev:22
melissa.motphimchilll.dev:8080
melissa.motphimchilll.dev:8880
melissa.motphimchilll.dev:2052
melissa.motphimchilll.dev:2082
melissa.motphimchilll.dev:2086
melissa.motphimchilll.dev:2095
melissa.motphimchilll.dev:443
melissa.motphimchilll.dev:2053
melissa.motphimchilll.dev:2083
melissa.motphimchilll.dev:2087
melissa.motphimchilll.dev:2096
melissa.motphimchilll.dev:8443
stuxnet.motphimchilll.dev:80
stuxnet.motphimchilll.dev:22
stuxnet.motphimchilll.dev:8080
stuxnet.motphimchilll.dev:8880
stuxnet.motphimchilll.dev:2052
stuxnet.motphimchilll.dev:2082
stuxnet.motphimchilll.dev:2086
stuxnet.motphimchilll.dev:2095
stuxnet.motphimchilll.dev:443
stuxnet.motphimchilll.dev:2053
stuxnet.motphimchilll.dev:2083
stuxnet.motphimchilll.dev:2087
stuxnet.motphimchilll.dev:2096
stuxnet.motphimchilll.dev:8443

Mutex

AFh5EkAAGxWi

Attributes

delay
0
install
true
install_file
2zyj6.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  47f3df5f93353fd987f9903d2d030d10cae10a4c74a799ef70ab48fa47c63f07
- Size 45KB
- SHA256 47f3df5f93353fd987f9903d2d030d10cae10a4c74a799ef70ab48fa47c63f07
- MD5 8a833b4ae18d134dcd131d52bc170e15
- SHA1 865166679d24021c7560719c6544507fe6e8b21a
- SHA512 8194eecbcf3b22928e21276bfed01fdb0cbd42475de527f3bc941967ce240660ec7558c8b5aaf9cfae14b138aca859ec561b1d58a057ce8bf7ab7516904afe43
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEa+PIvEjbZgX3ibYuGm+ZWXBDZMx:ku40ZTXEb2C4EaHvEb2XSbT8WRdMx
- TLSH
  T197233B003BE8C12BF2BE5F7898F26145867AF6637603D54D2CC4119B5613FC69A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2