asyncrat | c4ca87e1d8a07a0b97d038190dadb0a5ccc98569be653aeca27ef05756e3d2e5

Sharing

Copy URL Twitter E-mail

General

Target
c4ca87e1d8a07a0b97d038190dadb0a5ccc98569be653aeca27ef05756e3d2e5
Size 45KB
Sample260702-wdq8vsa161
SHA256 c4ca87e1d8a07a0b97d038190dadb0a5ccc98569be653aeca27ef05756e3d2e5
MD5 e058865c0027fa90b6a3d07222e35268
SHA1 555a5e108baef23b3e01f9db434121a0abf8c148
SHA512 753bf24df7278266ad0ea7976b7eaf804858e172de893e225160a3bd30e4178fd506ccbeba49260b7e8de4b1c0d20dc29d978da1376587379445bc1af77f14c8
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjbQgX3ioq1UQ6seWmBDw:MuLAZTnbg2vSAvQZh6OAE3bXXSWWeLdG
TLSH
T111231A003BE8C12BF2BF4FB8A9F26145867AF2632603D65E1CC451975713FC68A526ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chickengeeks.com:80
chickengeeks.com:22
chickengeeks.com:8080
chickengeeks.com:8880
chickengeeks.com:2052
chickengeeks.com:2082
chickengeeks.com:2086
chickengeeks.com:2095
chickengeeks.com:443
chickengeeks.com:2053
chickengeeks.com:2083
chickengeeks.com:2087
chickengeeks.com:2096
chickengeeks.com:8443
www.chickengeeks.com:80
www.chickengeeks.com:22
www.chickengeeks.com:8080
www.chickengeeks.com:8880
www.chickengeeks.com:2052
www.chickengeeks.com:2082
www.chickengeeks.com:2086
www.chickengeeks.com:2095
www.chickengeeks.com:443
www.chickengeeks.com:2053
www.chickengeeks.com:2083
www.chickengeeks.com:2087
www.chickengeeks.com:2096
www.chickengeeks.com:8443
triton.chickengeeks.com:80
triton.chickengeeks.com:22
triton.chickengeeks.com:8080
triton.chickengeeks.com:8880
triton.chickengeeks.com:2052
triton.chickengeeks.com:2082
triton.chickengeeks.com:2086
triton.chickengeeks.com:2095
triton.chickengeeks.com:443
triton.chickengeeks.com:2053
triton.chickengeeks.com:2083
triton.chickengeeks.com:2087
triton.chickengeeks.com:2096
triton.chickengeeks.com:8443
trisis.chickengeeks.com:80
trisis.chickengeeks.com:22
trisis.chickengeeks.com:8080
trisis.chickengeeks.com:8880
trisis.chickengeeks.com:2052
trisis.chickengeeks.com:2082
trisis.chickengeeks.com:2086
trisis.chickengeeks.com:2095
trisis.chickengeeks.com:443
trisis.chickengeeks.com:2053
trisis.chickengeeks.com:2083
trisis.chickengeeks.com:2087
trisis.chickengeeks.com:2096
trisis.chickengeeks.com:8443
connect.chickengeeks.com:80
connect.chickengeeks.com:22
connect.chickengeeks.com:8080
connect.chickengeeks.com:8880
connect.chickengeeks.com:2052
connect.chickengeeks.com:2082
connect.chickengeeks.com:2086
connect.chickengeeks.com:2095
connect.chickengeeks.com:443
connect.chickengeeks.com:2053
connect.chickengeeks.com:2083
connect.chickengeeks.com:2087
connect.chickengeeks.com:2096
connect.chickengeeks.com:8443

Mutex

y7yNS0cYXylO

Attributes

delay
0
install
true
install_file
6vz4z.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c4ca87e1d8a07a0b97d038190dadb0a5ccc98569be653aeca27ef05756e3d2e5
- Size 45KB
- SHA256 c4ca87e1d8a07a0b97d038190dadb0a5ccc98569be653aeca27ef05756e3d2e5
- MD5 e058865c0027fa90b6a3d07222e35268
- SHA1 555a5e108baef23b3e01f9db434121a0abf8c148
- SHA512 753bf24df7278266ad0ea7976b7eaf804858e172de893e225160a3bd30e4178fd506ccbeba49260b7e8de4b1c0d20dc29d978da1376587379445bc1af77f14c8
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjbQgX3ioq1UQ6seWmBDw:MuLAZTnbg2vSAvQZh6OAE3bXXSWWeLdG
- TLSH
  T111231A003BE8C12BF2BF4FB8A9F26145867AF2632603D65E1CC451975713FC68A526ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2