asyncrat | 0bb513c72ada9d4882d1f6695aaefbc4b872532c66a9170abba0216297e9079c

Sharing

Copy URL Twitter E-mail

General

Target
0bb513c72ada9d4882d1f6695aaefbc4b872532c66a9170abba0216297e9079c
Size 45KB
Sample260718-nafnyscx3z
SHA256 0bb513c72ada9d4882d1f6695aaefbc4b872532c66a9170abba0216297e9079c
MD5 a6d4be305c8ad6787eb85a29e8f570a1
SHA1 f9e6d8258fcde453d3732cdb44e3025122d7f4c0
SHA512 7761d864183d983d201ce4c5c572ed7d14a878648c07d0a88c5c203df0b5d609e15a0aa74182d4ae3a8745a2a020ffba3a827fca0d987698c3397dc04628f071
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QPCBAPSNjPIRzjbOgX3issxxwdVJtFKOLVBDZu:EufspTf2g2hO5svSKR3bxXSjxGdVJtdu
TLSH
T13A232A003BE8C12BF2BE5F7899F26145467AF2673603E5492CC452DB5613FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chichgai.one:80
chichgai.one:22
chichgai.one:8080
chichgai.one:8880
chichgai.one:2052
chichgai.one:2082
chichgai.one:2086
chichgai.one:2095
chichgai.one:443
chichgai.one:2053
chichgai.one:2083
chichgai.one:2087
chichgai.one:2096
chichgai.one:8443
www.chichgai.one:80
www.chichgai.one:22
www.chichgai.one:8080
www.chichgai.one:8880
www.chichgai.one:2052
www.chichgai.one:2082
www.chichgai.one:2086
www.chichgai.one:2095
www.chichgai.one:443
www.chichgai.one:2053
www.chichgai.one:2083
www.chichgai.one:2087
www.chichgai.one:2096
www.chichgai.one:8443
malware.chichgai.one:80
malware.chichgai.one:22
malware.chichgai.one:8080
malware.chichgai.one:8880
malware.chichgai.one:2052
malware.chichgai.one:2082
malware.chichgai.one:2086
malware.chichgai.one:2095
malware.chichgai.one:443
malware.chichgai.one:2053
malware.chichgai.one:2083
malware.chichgai.one:2087
malware.chichgai.one:2096
malware.chichgai.one:8443
hermeticwiper.chichgai.one:80
hermeticwiper.chichgai.one:22
hermeticwiper.chichgai.one:8080
hermeticwiper.chichgai.one:8880
hermeticwiper.chichgai.one:2052
hermeticwiper.chichgai.one:2082
hermeticwiper.chichgai.one:2086
hermeticwiper.chichgai.one:2095
hermeticwiper.chichgai.one:443
hermeticwiper.chichgai.one:2053
hermeticwiper.chichgai.one:2083
hermeticwiper.chichgai.one:2087
hermeticwiper.chichgai.one:2096
hermeticwiper.chichgai.one:8443
hacker.chichgai.one:80
hacker.chichgai.one:22
hacker.chichgai.one:8080
hacker.chichgai.one:8880
hacker.chichgai.one:2052
hacker.chichgai.one:2082
hacker.chichgai.one:2086
hacker.chichgai.one:2095
hacker.chichgai.one:443
hacker.chichgai.one:2053
hacker.chichgai.one:2083
hacker.chichgai.one:2087
hacker.chichgai.one:2096
hacker.chichgai.one:8443

Mutex

60zGb8uv8yrv

Attributes

delay
0
install
true
install_file
m99z2hu.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  0bb513c72ada9d4882d1f6695aaefbc4b872532c66a9170abba0216297e9079c
- Size 45KB
- SHA256 0bb513c72ada9d4882d1f6695aaefbc4b872532c66a9170abba0216297e9079c
- MD5 a6d4be305c8ad6787eb85a29e8f570a1
- SHA1 f9e6d8258fcde453d3732cdb44e3025122d7f4c0
- SHA512 7761d864183d983d201ce4c5c572ed7d14a878648c07d0a88c5c203df0b5d609e15a0aa74182d4ae3a8745a2a020ffba3a827fca0d987698c3397dc04628f071
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QPCBAPSNjPIRzjbOgX3issxxwdVJtFKOLVBDZu:EufspTf2g2hO5svSKR3bxXSjxGdVJtdu
- TLSH
  T13A232A003BE8C12BF2BE5F7899F26145467AF2673603E5492CC452DB5613FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2