asyncrat | 78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee

Sharing

Copy URL Twitter E-mail

General

Target
78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee
Size 45KB
Sample260718-thttfaav3t
SHA256 78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee
MD5 1e22d9e1aaa721ab93186adcc5fec048
SHA1 2d85037a530670b9882e9ebfcb906ec5c62bfaaf
SHA512 2aba6b49a6806362243371b5e51fafa5444f4ff710692aa78b4703f67c11d9f661e9420c54f3a6b91985a676ee4c2f4776ea221951d54975ff605b89445d958d
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AcQSCBznqNLPI7zjb4gX3iMgyalNlBxuBDZsx:EufspTf2g2Jc9UqC73bvXSMgyvdsx
TLSH
T128232B003BE8812AF1BE4F78A8F26145867AF6637603E94D2CC451DB5A13FC6D6426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chichgai.one:80
chichgai.one:22
chichgai.one:8080
chichgai.one:8880
chichgai.one:2052
chichgai.one:2082
chichgai.one:2086
chichgai.one:2095
chichgai.one:443
chichgai.one:2053
chichgai.one:2083
chichgai.one:2087
chichgai.one:2096
chichgai.one:8443
www.chichgai.one:80
www.chichgai.one:22
www.chichgai.one:8080
www.chichgai.one:8880
www.chichgai.one:2052
www.chichgai.one:2082
www.chichgai.one:2086
www.chichgai.one:2095
www.chichgai.one:443
www.chichgai.one:2053
www.chichgai.one:2083
www.chichgai.one:2087
www.chichgai.one:2096
www.chichgai.one:8443
rat.chichgai.one:80
rat.chichgai.one:22
rat.chichgai.one:8080
rat.chichgai.one:8880
rat.chichgai.one:2052
rat.chichgai.one:2082
rat.chichgai.one:2086
rat.chichgai.one:2095
rat.chichgai.one:443
rat.chichgai.one:2053
rat.chichgai.one:2083
rat.chichgai.one:2087
rat.chichgai.one:2096
rat.chichgai.one:8443
qakbot.chichgai.one:80
qakbot.chichgai.one:22
qakbot.chichgai.one:8080
qakbot.chichgai.one:8880
qakbot.chichgai.one:2052
qakbot.chichgai.one:2082
qakbot.chichgai.one:2086
qakbot.chichgai.one:2095
qakbot.chichgai.one:443
qakbot.chichgai.one:2053
qakbot.chichgai.one:2083
qakbot.chichgai.one:2087
qakbot.chichgai.one:2096
qakbot.chichgai.one:8443
client.chichgai.one:80
client.chichgai.one:22
client.chichgai.one:8080
client.chichgai.one:8880
client.chichgai.one:2052
client.chichgai.one:2082
client.chichgai.one:2086
client.chichgai.one:2095
client.chichgai.one:443
client.chichgai.one:2053
client.chichgai.one:2083
client.chichgai.one:2087
client.chichgai.one:2096
client.chichgai.one:8443
socgholish.chichgai.one:80
socgholish.chichgai.one:22
socgholish.chichgai.one:8080
socgholish.chichgai.one:8880
socgholish.chichgai.one:2052
socgholish.chichgai.one:2082
socgholish.chichgai.one:2086
socgholish.chichgai.one:2095
socgholish.chichgai.one:443
socgholish.chichgai.one:2053
socgholish.chichgai.one:2083
socgholish.chichgai.one:2087
socgholish.chichgai.one:2096
socgholish.chichgai.one:8443

Mutex

8UjEGyuV53CB

Attributes

delay
0
install
true
install_file
n1b8juz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee
- Size 45KB
- SHA256 78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee
- MD5 1e22d9e1aaa721ab93186adcc5fec048
- SHA1 2d85037a530670b9882e9ebfcb906ec5c62bfaaf
- SHA512 2aba6b49a6806362243371b5e51fafa5444f4ff710692aa78b4703f67c11d9f661e9420c54f3a6b91985a676ee4c2f4776ea221951d54975ff605b89445d958d
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AcQSCBznqNLPI7zjb4gX3iMgyalNlBxuBDZsx:EufspTf2g2Jc9UqC73bvXSMgyvdsx
- TLSH
  T128232B003BE8812AF1BE4F78A8F26145867AF6637603E94D2CC451DB5A13FC6D6426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2