asyncrat | e7c390d62f3cc92575de7c3a1c542d1228df4482d22cdb5412f2a3764c8c96dc

Sharing

Copy URL Twitter E-mail

General

Target
e7c390d62f3cc92575de7c3a1c542d1228df4482d22cdb5412f2a3764c8c96dc
Size 45KB
Sample260717-wpp5yahv8m
SHA256 e7c390d62f3cc92575de7c3a1c542d1228df4482d22cdb5412f2a3764c8c96dc
MD5 709f94ac74e46b2041f12d219e53c10b
SHA1 9b7a93d541c9d445376778fcbcb3d4b4cffdcc10
SHA512 b4ee432cad19b8f8ca10603f4b63573b9c92e6357d755df07ee99a941065deefbe4a7a9146ef6671309d22a0a774482d4b49210ccc7eb8d9981faa4fa5633a86
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9yiaLMwJAOPIcAzjbNgXsiEtUEEtfOidYrMBDZsx:EulCJTHl42l5n23cA3baXJkUPfVdsKdu
TLSH
T1E5230A003BE8C22BF2BE4B74ACF26145867AB6673603D54A1CC451DB5613FC69A42AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chichgai.one:80
chichgai.one:22
chichgai.one:8080
chichgai.one:8880
chichgai.one:2052
chichgai.one:2082
chichgai.one:2086
chichgai.one:2095
chichgai.one:443
chichgai.one:2053
chichgai.one:2083
chichgai.one:2087
chichgai.one:2096
chichgai.one:8443
www.chichgai.one:80
www.chichgai.one:22
www.chichgai.one:8080
www.chichgai.one:8880
www.chichgai.one:2052
www.chichgai.one:2082
www.chichgai.one:2086
www.chichgai.one:2095
www.chichgai.one:443
www.chichgai.one:2053
www.chichgai.one:2083
www.chichgai.one:2087
www.chichgai.one:2096
www.chichgai.one:8443
dridex.chichgai.one:80
dridex.chichgai.one:22
dridex.chichgai.one:8080
dridex.chichgai.one:8880
dridex.chichgai.one:2052
dridex.chichgai.one:2082
dridex.chichgai.one:2086
dridex.chichgai.one:2095
dridex.chichgai.one:443
dridex.chichgai.one:2053
dridex.chichgai.one:2083
dridex.chichgai.one:2087
dridex.chichgai.one:2096
dridex.chichgai.one:8443
gh0st.chichgai.one:80
gh0st.chichgai.one:22
gh0st.chichgai.one:8080
gh0st.chichgai.one:8880
gh0st.chichgai.one:2052
gh0st.chichgai.one:2082
gh0st.chichgai.one:2086
gh0st.chichgai.one:2095
gh0st.chichgai.one:443
gh0st.chichgai.one:2053
gh0st.chichgai.one:2083
gh0st.chichgai.one:2087
gh0st.chichgai.one:2096
gh0st.chichgai.one:8443
lokibot.chichgai.one:80
lokibot.chichgai.one:22
lokibot.chichgai.one:8080
lokibot.chichgai.one:8880
lokibot.chichgai.one:2052
lokibot.chichgai.one:2082
lokibot.chichgai.one:2086
lokibot.chichgai.one:2095
lokibot.chichgai.one:443
lokibot.chichgai.one:2053
lokibot.chichgai.one:2083
lokibot.chichgai.one:2087
lokibot.chichgai.one:2096
lokibot.chichgai.one:8443
ursnif.chichgai.one:80
ursnif.chichgai.one:22
ursnif.chichgai.one:8080
ursnif.chichgai.one:8880
ursnif.chichgai.one:2052
ursnif.chichgai.one:2082
ursnif.chichgai.one:2086
ursnif.chichgai.one:2095
ursnif.chichgai.one:443
ursnif.chichgai.one:2053
ursnif.chichgai.one:2083
ursnif.chichgai.one:2087
ursnif.chichgai.one:2096
ursnif.chichgai.one:8443

Mutex

cQqFCzjhMHSD

Attributes

delay
0
install
true
install_file
ttn1tn.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  e7c390d62f3cc92575de7c3a1c542d1228df4482d22cdb5412f2a3764c8c96dc
- Size 45KB
- SHA256 e7c390d62f3cc92575de7c3a1c542d1228df4482d22cdb5412f2a3764c8c96dc
- MD5 709f94ac74e46b2041f12d219e53c10b
- SHA1 9b7a93d541c9d445376778fcbcb3d4b4cffdcc10
- SHA512 b4ee432cad19b8f8ca10603f4b63573b9c92e6357d755df07ee99a941065deefbe4a7a9146ef6671309d22a0a774482d4b49210ccc7eb8d9981faa4fa5633a86
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9yiaLMwJAOPIcAzjbNgXsiEtUEEtfOidYrMBDZsx:EulCJTHl42l5n23cA3baXJkUPfVdsKdu
- TLSH
  T1E5230A003BE8C22BF2BE4B74ACF26145867AB6673603D54A1CC451DB5613FC69A42AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2