asyncrat | 5671b6479dfd2a03c7a87cb22538e0c77ee7d345b942a5bae63f03bf88e890e0

Sharing

Copy URL Twitter E-mail

General

Target
5671b6479dfd2a03c7a87cb22538e0c77ee7d345b942a5bae63f03bf88e890e0
Size 45KB
Sample260717-rrjcysds2l
SHA256 5671b6479dfd2a03c7a87cb22538e0c77ee7d345b942a5bae63f03bf88e890e0
MD5 6019159d8218111e1b5ec2173a608df7
SHA1 2fb81db785223697de448038237791bfbfc4080c
SHA512 eaffced9bbe998a890e29af97f0aadd74f970031afebfd3b44026e8d56d7e76998c0235c57bdf692dbd339381dd7bbc2ef28fcf7394435cb4ca83eae28dc5b62
SSDEEP 768:IuR0JTPUYkEWUmjWymo2q1/sD/pneqPIkzjbLgX3i8uLjH+ztjea5URBDZox:IuR0JTPjY2ksjJeTk3b0XSx+caWvdox
TLSH
T1FB233C003BE9812BF2BE5F7898F26145867AF2633603D54A2CC442DB5713FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chichgai.one:80
chichgai.one:22
chichgai.one:8080
chichgai.one:8880
chichgai.one:2052
chichgai.one:2082
chichgai.one:2086
chichgai.one:2095
chichgai.one:443
chichgai.one:2053
chichgai.one:2083
chichgai.one:2087
chichgai.one:2096
chichgai.one:8443
www.chichgai.one:80
www.chichgai.one:22
www.chichgai.one:8080
www.chichgai.one:8880
www.chichgai.one:2052
www.chichgai.one:2082
www.chichgai.one:2086
www.chichgai.one:2095
www.chichgai.one:443
www.chichgai.one:2053
www.chichgai.one:2083
www.chichgai.one:2087
www.chichgai.one:2096
www.chichgai.one:8443
remcos.chichgai.one:80
remcos.chichgai.one:22
remcos.chichgai.one:8080
remcos.chichgai.one:8880
remcos.chichgai.one:2052
remcos.chichgai.one:2082
remcos.chichgai.one:2086
remcos.chichgai.one:2095
remcos.chichgai.one:443
remcos.chichgai.one:2053
remcos.chichgai.one:2083
remcos.chichgai.one:2087
remcos.chichgai.one:2096
remcos.chichgai.one:8443
formbook.chichgai.one:80
formbook.chichgai.one:22
formbook.chichgai.one:8080
formbook.chichgai.one:8880
formbook.chichgai.one:2052
formbook.chichgai.one:2082
formbook.chichgai.one:2086
formbook.chichgai.one:2095
formbook.chichgai.one:443
formbook.chichgai.one:2053
formbook.chichgai.one:2083
formbook.chichgai.one:2087
formbook.chichgai.one:2096
formbook.chichgai.one:8443
sasser.chichgai.one:80
sasser.chichgai.one:22
sasser.chichgai.one:8080
sasser.chichgai.one:8880
sasser.chichgai.one:2052
sasser.chichgai.one:2082
sasser.chichgai.one:2086
sasser.chichgai.one:2095
sasser.chichgai.one:443
sasser.chichgai.one:2053
sasser.chichgai.one:2083
sasser.chichgai.one:2087
sasser.chichgai.one:2096
sasser.chichgai.one:8443

Mutex

JO0o1nMNufrH

Attributes

delay
0
install
true
install_file
m68v.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5671b6479dfd2a03c7a87cb22538e0c77ee7d345b942a5bae63f03bf88e890e0
- Size 45KB
- SHA256 5671b6479dfd2a03c7a87cb22538e0c77ee7d345b942a5bae63f03bf88e890e0
- MD5 6019159d8218111e1b5ec2173a608df7
- SHA1 2fb81db785223697de448038237791bfbfc4080c
- SHA512 eaffced9bbe998a890e29af97f0aadd74f970031afebfd3b44026e8d56d7e76998c0235c57bdf692dbd339381dd7bbc2ef28fcf7394435cb4ca83eae28dc5b62
- SSDEEP 768:IuR0JTPUYkEWUmjWymo2q1/sD/pneqPIkzjbLgX3i8uLjH+ztjea5URBDZox:IuR0JTPjY2ksjJeTk3b0XSx+caWvdox
- TLSH
  T1FB233C003BE9812BF2BE5F7898F26145867AF2633603D54A2CC442DB5713FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2