asyncrat | 887e4b3d630ea01b27848c940474d60cf3dbe74acb2e377fa9c50f6b48fb3461

Sharing

Copy URL Twitter E-mail

General

Target
887e4b3d630ea01b27848c940474d60cf3dbe74acb2e377fa9c50f6b48fb3461
Size 45KB
Sample260717-rps5dac17p
SHA256 887e4b3d630ea01b27848c940474d60cf3dbe74acb2e377fa9c50f6b48fb3461
MD5 3801d5b2336ccab61ca1fdc301b536f4
SHA1 2d5c12a4d914167b903d2bf63136c059f73ffdf9
SHA512 2f84da54ec4cf62c47fac080c1fd5824b22a1a958f189a46b17081a48c0f6a5eed0da34a04901bcc7d4e5ec6cb7cd14427e1a3c9f615e8b8d09cac58d2e1720c
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFhlsNoPEaMPIcWjbbgX3ikz8C1wMD3P3OCihppBDZW:cu7e5TH2A2wsuEaxcabkXSY8EF3P3OCX
TLSH
T1FC232B003BE8822BF2BE4F7869F26145467EF2637603D54A1CC412D75613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chichgai.one:80
chichgai.one:22
chichgai.one:8080
chichgai.one:8880
chichgai.one:2052
chichgai.one:2082
chichgai.one:2086
chichgai.one:2095
chichgai.one:443
chichgai.one:2053
chichgai.one:2083
chichgai.one:2087
chichgai.one:2096
chichgai.one:8443
www.chichgai.one:80
www.chichgai.one:22
www.chichgai.one:8080
www.chichgai.one:8880
www.chichgai.one:2052
www.chichgai.one:2082
www.chichgai.one:2086
www.chichgai.one:2095
www.chichgai.one:443
www.chichgai.one:2053
www.chichgai.one:2083
www.chichgai.one:2087
www.chichgai.one:2096
www.chichgai.one:8443
lokibot.chichgai.one:80
lokibot.chichgai.one:22
lokibot.chichgai.one:8080
lokibot.chichgai.one:8880
lokibot.chichgai.one:2052
lokibot.chichgai.one:2082
lokibot.chichgai.one:2086
lokibot.chichgai.one:2095
lokibot.chichgai.one:443
lokibot.chichgai.one:2053
lokibot.chichgai.one:2083
lokibot.chichgai.one:2087
lokibot.chichgai.one:2096
lokibot.chichgai.one:8443
fakeupdates.chichgai.one:80
fakeupdates.chichgai.one:22
fakeupdates.chichgai.one:8080
fakeupdates.chichgai.one:8880
fakeupdates.chichgai.one:2052
fakeupdates.chichgai.one:2082
fakeupdates.chichgai.one:2086
fakeupdates.chichgai.one:2095
fakeupdates.chichgai.one:443
fakeupdates.chichgai.one:2053
fakeupdates.chichgai.one:2083
fakeupdates.chichgai.one:2087
fakeupdates.chichgai.one:2096
fakeupdates.chichgai.one:8443
trisis.chichgai.one:80
trisis.chichgai.one:22
trisis.chichgai.one:8080
trisis.chichgai.one:8880
trisis.chichgai.one:2052
trisis.chichgai.one:2082
trisis.chichgai.one:2086
trisis.chichgai.one:2095
trisis.chichgai.one:443
trisis.chichgai.one:2053
trisis.chichgai.one:2083
trisis.chichgai.one:2087
trisis.chichgai.one:2096
trisis.chichgai.one:8443

Mutex

JLKmF4ZVmmwI

Attributes

delay
0
install
true
install_file
14n8d.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  887e4b3d630ea01b27848c940474d60cf3dbe74acb2e377fa9c50f6b48fb3461
- Size 45KB
- SHA256 887e4b3d630ea01b27848c940474d60cf3dbe74acb2e377fa9c50f6b48fb3461
- MD5 3801d5b2336ccab61ca1fdc301b536f4
- SHA1 2d5c12a4d914167b903d2bf63136c059f73ffdf9
- SHA512 2f84da54ec4cf62c47fac080c1fd5824b22a1a958f189a46b17081a48c0f6a5eed0da34a04901bcc7d4e5ec6cb7cd14427e1a3c9f615e8b8d09cac58d2e1720c
- SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFhlsNoPEaMPIcWjbbgX3ikz8C1wMD3P3OCihppBDZW:cu7e5TH2A2wsuEaxcabkXSY8EF3P3OCX
- TLSH
  T1FC232B003BE8822BF2BE4F7869F26145467EF2637603D54A1CC412D75613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2