asyncrat | b4ba99ef5abeeead0a35b89ee25aa6f7c49a5c4eab6340c0646f21860b7b039a

Sharing

Copy URL Twitter E-mail

General

Target
b4ba99ef5abeeead0a35b89ee25aa6f7c49a5c4eab6340c0646f21860b7b039a
Size 45KB
Sample260717-sj77saes2k
SHA256 b4ba99ef5abeeead0a35b89ee25aa6f7c49a5c4eab6340c0646f21860b7b039a
MD5 da6116de9ca1f3a78a83ab75c5aa0ca9
SHA1 4fa848b857f587aa9a96f397b1b2a558114e32a0
SHA512 60b9f08aa8f8f006af34f07c86abdc25a00ff9d6d30dd431b9e84b282427de6dda4105e1a2a40ae4278fc96d447cb4fc1236ae0553b37ee0485e6fa08d4dca18
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4j9YqPq/hOPIezjb0gX3ieeiO8+VxYBQByZTtuBBU:8uUIpT4vAj2naqC3e3bbXStil+MB+uIU
TLSH
T1CF232A003BE9C12BF2BE4F789CF26145867AB2633603D54A1CC452975723FC69A526FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chichgai.one:80
chichgai.one:22
chichgai.one:8080
chichgai.one:8880
chichgai.one:2052
chichgai.one:2082
chichgai.one:2086
chichgai.one:2095
chichgai.one:443
chichgai.one:2053
chichgai.one:2083
chichgai.one:2087
chichgai.one:2096
chichgai.one:8443
www.chichgai.one:80
www.chichgai.one:22
www.chichgai.one:8080
www.chichgai.one:8880
www.chichgai.one:2052
www.chichgai.one:2082
www.chichgai.one:2086
www.chichgai.one:2095
www.chichgai.one:443
www.chichgai.one:2053
www.chichgai.one:2083
www.chichgai.one:2087
www.chichgai.one:2096
www.chichgai.one:8443
malware.chichgai.one:80
malware.chichgai.one:22
malware.chichgai.one:8080
malware.chichgai.one:8880
malware.chichgai.one:2052
malware.chichgai.one:2082
malware.chichgai.one:2086
malware.chichgai.one:2095
malware.chichgai.one:443
malware.chichgai.one:2053
malware.chichgai.one:2083
malware.chichgai.one:2087
malware.chichgai.one:2096
malware.chichgai.one:8443
hermeticwiper.chichgai.one:80
hermeticwiper.chichgai.one:22
hermeticwiper.chichgai.one:8080
hermeticwiper.chichgai.one:8880
hermeticwiper.chichgai.one:2052
hermeticwiper.chichgai.one:2082
hermeticwiper.chichgai.one:2086
hermeticwiper.chichgai.one:2095
hermeticwiper.chichgai.one:443
hermeticwiper.chichgai.one:2053
hermeticwiper.chichgai.one:2083
hermeticwiper.chichgai.one:2087
hermeticwiper.chichgai.one:2096
hermeticwiper.chichgai.one:8443
wannacry.chichgai.one:80
wannacry.chichgai.one:22
wannacry.chichgai.one:8080
wannacry.chichgai.one:8880
wannacry.chichgai.one:2052
wannacry.chichgai.one:2082
wannacry.chichgai.one:2086
wannacry.chichgai.one:2095
wannacry.chichgai.one:443
wannacry.chichgai.one:2053
wannacry.chichgai.one:2083
wannacry.chichgai.one:2087
wannacry.chichgai.one:2096
wannacry.chichgai.one:8443
gootloader.chichgai.one:80
gootloader.chichgai.one:22
gootloader.chichgai.one:8080
gootloader.chichgai.one:8880
gootloader.chichgai.one:2052
gootloader.chichgai.one:2082
gootloader.chichgai.one:2086
gootloader.chichgai.one:2095
gootloader.chichgai.one:443
gootloader.chichgai.one:2053
gootloader.chichgai.one:2083
gootloader.chichgai.one:2087
gootloader.chichgai.one:2096
gootloader.chichgai.one:8443

Mutex

nmvI9wJ2GcNT

Attributes

delay
0
install
true
install_file
yvkajze.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b4ba99ef5abeeead0a35b89ee25aa6f7c49a5c4eab6340c0646f21860b7b039a
- Size 45KB
- SHA256 b4ba99ef5abeeead0a35b89ee25aa6f7c49a5c4eab6340c0646f21860b7b039a
- MD5 da6116de9ca1f3a78a83ab75c5aa0ca9
- SHA1 4fa848b857f587aa9a96f397b1b2a558114e32a0
- SHA512 60b9f08aa8f8f006af34f07c86abdc25a00ff9d6d30dd431b9e84b282427de6dda4105e1a2a40ae4278fc96d447cb4fc1236ae0553b37ee0485e6fa08d4dca18
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4j9YqPq/hOPIezjb0gX3ieeiO8+VxYBQByZTtuBBU:8uUIpT4vAj2naqC3e3bbXStil+MB+uIU
- TLSH
  T1CF232A003BE9C12BF2BE4F789CF26145867AB2633603D54A1CC452975723FC69A526FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2