asyncrat | 41d4c58cf60086059e3b1734192a7f6b8e7d41444be3d080c60dc7a9bf5a95c3

Resubmissions

18/07/2026, 14:17

260718-rl6ajagx7s

18/07/2026, 14:08

260718-rfh8tagw4110

Sharing

Copy URL Twitter E-mail

General

Target
41d4c58cf60086059e3b1734192a7f6b8e7d41444be3d080c60dc7a9bf5a95c3
Size 45KB
Sample260718-rfh8tagw41
SHA256 41d4c58cf60086059e3b1734192a7f6b8e7d41444be3d080c60dc7a9bf5a95c3
MD5 d9abd08f53b98ee7d8cc53821c8c6546
SHA1 318a73d4b666d34c4b00dbc07fa54fef37f4bef2
SHA512 c90c3a630beaadff95a3d3a940009d198a97988bf93dd2333c13758ca82616ecdba0f1b7524e7b3663e565d21ba0074ceb883da1a77027972d6dfe3929e94caa
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE02FjMdjYkkmPIKzjbUgX3iqDDsUBmyyQJPNoa5:cuR0JTPjY2SL9wQPK3b7XScD9BbVJMdW
TLSH
T187232A0037E9822BF2BE4B786DF26205467AF5732603D64D1C8451DB5B23FC68643AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chichgai.one:80
chichgai.one:22
chichgai.one:8080
chichgai.one:8880
chichgai.one:2052
chichgai.one:2082
chichgai.one:2086
chichgai.one:2095
chichgai.one:443
chichgai.one:2053
chichgai.one:2083
chichgai.one:2087
chichgai.one:2096
chichgai.one:8443
www.chichgai.one:80
www.chichgai.one:22
www.chichgai.one:8080
www.chichgai.one:8880
www.chichgai.one:2052
www.chichgai.one:2082
www.chichgai.one:2086
www.chichgai.one:2095
www.chichgai.one:443
www.chichgai.one:2053
www.chichgai.one:2083
www.chichgai.one:2087
www.chichgai.one:2096
www.chichgai.one:8443
nimda.chichgai.one:80
nimda.chichgai.one:22
nimda.chichgai.one:8080
nimda.chichgai.one:8880
nimda.chichgai.one:2052
nimda.chichgai.one:2082
nimda.chichgai.one:2086
nimda.chichgai.one:2095
nimda.chichgai.one:443
nimda.chichgai.one:2053
nimda.chichgai.one:2083
nimda.chichgai.one:2087
nimda.chichgai.one:2096
nimda.chichgai.one:8443
lokibot.chichgai.one:80
lokibot.chichgai.one:22
lokibot.chichgai.one:8080
lokibot.chichgai.one:8880
lokibot.chichgai.one:2052
lokibot.chichgai.one:2082
lokibot.chichgai.one:2086
lokibot.chichgai.one:2095
lokibot.chichgai.one:443
lokibot.chichgai.one:2053
lokibot.chichgai.one:2083
lokibot.chichgai.one:2087
lokibot.chichgai.one:2096
lokibot.chichgai.one:8443
dridex.chichgai.one:80
dridex.chichgai.one:22
dridex.chichgai.one:8080
dridex.chichgai.one:8880
dridex.chichgai.one:2052
dridex.chichgai.one:2082
dridex.chichgai.one:2086
dridex.chichgai.one:2095
dridex.chichgai.one:443
dridex.chichgai.one:2053
dridex.chichgai.one:2083
dridex.chichgai.one:2087
dridex.chichgai.one:2096
dridex.chichgai.one:8443

Mutex

VNutVeNs0Oox

Attributes

delay
0
install
true
install_file
rqr5.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  41d4c58cf60086059e3b1734192a7f6b8e7d41444be3d080c60dc7a9bf5a95c3
- Size 45KB
- SHA256 41d4c58cf60086059e3b1734192a7f6b8e7d41444be3d080c60dc7a9bf5a95c3
- MD5 d9abd08f53b98ee7d8cc53821c8c6546
- SHA1 318a73d4b666d34c4b00dbc07fa54fef37f4bef2
- SHA512 c90c3a630beaadff95a3d3a940009d198a97988bf93dd2333c13758ca82616ecdba0f1b7524e7b3663e565d21ba0074ceb883da1a77027972d6dfe3929e94caa
- SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE02FjMdjYkkmPIKzjbUgX3iqDDsUBmyyQJPNoa5:cuR0JTPjY2SL9wQPK3b7XScD9BbVJMdW
- TLSH
  T187232A0037E9822BF2BE4B786DF26205467AF5732603D64D1C8451DB5B23FC68643AF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2