asyncrat | d668c577f0cfcfad504b50c889934514e4e134ba9ab3f1ede2702aba96b6a008

Sharing

Copy URL Twitter E-mail

General

Target
d668c577f0cfcfad504b50c889934514e4e134ba9ab3f1ede2702aba96b6a008
Size 45KB
Sample260718-kk796ses3j
SHA256 d668c577f0cfcfad504b50c889934514e4e134ba9ab3f1ede2702aba96b6a008
MD5 69e1909e601cbf3b8329299b9d0447ca
SHA1 55caaeb07d8e7690e9dc0aeab9afc08d83ce54ac
SHA512 33914820801974c15e5c21ee320176289e4a0e322da5cb22775dcadfdea3b035ab2c444281c9ab9cbf9e52476b7fce285b709730929fb666a072b19306d1b28d
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1P/qpG3jHuPIgzjbEgXpilsGoHR1qELMPBDZUx:cu6YepTPso2yIM3g3bLXYBopidUx
TLSH
T1CB2329003BE9812BF2BE4FB8A8F26145467EF1637603D6891CC451DB5623FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chichgai.one:80
chichgai.one:22
chichgai.one:8080
chichgai.one:8880
chichgai.one:2052
chichgai.one:2082
chichgai.one:2086
chichgai.one:2095
chichgai.one:443
chichgai.one:2053
chichgai.one:2083
chichgai.one:2087
chichgai.one:2096
chichgai.one:8443
www.chichgai.one:80
www.chichgai.one:22
www.chichgai.one:8080
www.chichgai.one:8880
www.chichgai.one:2052
www.chichgai.one:2082
www.chichgai.one:2086
www.chichgai.one:2095
www.chichgai.one:443
www.chichgai.one:2053
www.chichgai.one:2083
www.chichgai.one:2087
www.chichgai.one:2096
www.chichgai.one:8443
locky.chichgai.one:80
locky.chichgai.one:22
locky.chichgai.one:8080
locky.chichgai.one:8880
locky.chichgai.one:2052
locky.chichgai.one:2082
locky.chichgai.one:2086
locky.chichgai.one:2095
locky.chichgai.one:443
locky.chichgai.one:2053
locky.chichgai.one:2083
locky.chichgai.one:2087
locky.chichgai.one:2096
locky.chichgai.one:8443
mirai.chichgai.one:80
mirai.chichgai.one:22
mirai.chichgai.one:8080
mirai.chichgai.one:8880
mirai.chichgai.one:2052
mirai.chichgai.one:2082
mirai.chichgai.one:2086
mirai.chichgai.one:2095
mirai.chichgai.one:443
mirai.chichgai.one:2053
mirai.chichgai.one:2083
mirai.chichgai.one:2087
mirai.chichgai.one:2096
mirai.chichgai.one:8443
blaster.chichgai.one:80
blaster.chichgai.one:22
blaster.chichgai.one:8080
blaster.chichgai.one:8880
blaster.chichgai.one:2052
blaster.chichgai.one:2082
blaster.chichgai.one:2086
blaster.chichgai.one:2095
blaster.chichgai.one:443
blaster.chichgai.one:2053
blaster.chichgai.one:2083
blaster.chichgai.one:2087
blaster.chichgai.one:2096
blaster.chichgai.one:8443
hacker.chichgai.one:80
hacker.chichgai.one:22
hacker.chichgai.one:8080
hacker.chichgai.one:8880
hacker.chichgai.one:2052
hacker.chichgai.one:2082
hacker.chichgai.one:2086
hacker.chichgai.one:2095
hacker.chichgai.one:443
hacker.chichgai.one:2053
hacker.chichgai.one:2083
hacker.chichgai.one:2087
hacker.chichgai.one:2096
hacker.chichgai.one:8443

Mutex

up50lcEp6ZtS

Attributes

delay
0
install
true
install_file
kjpeqj2q.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  d668c577f0cfcfad504b50c889934514e4e134ba9ab3f1ede2702aba96b6a008
- Size 45KB
- SHA256 d668c577f0cfcfad504b50c889934514e4e134ba9ab3f1ede2702aba96b6a008
- MD5 69e1909e601cbf3b8329299b9d0447ca
- SHA1 55caaeb07d8e7690e9dc0aeab9afc08d83ce54ac
- SHA512 33914820801974c15e5c21ee320176289e4a0e322da5cb22775dcadfdea3b035ab2c444281c9ab9cbf9e52476b7fce285b709730929fb666a072b19306d1b28d
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1P/qpG3jHuPIgzjbEgXpilsGoHR1qELMPBDZUx:cu6YepTPso2yIM3g3bLXYBopidUx
- TLSH
  T1CB2329003BE9812BF2BE4FB8A8F26145467EF1637603D6891CC451DB5623FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2