asyncrat | 534b6c0ec08f77c5a8c3bbcf2abd3e47f380ab70f712979e53e8ce211dd4cc9a

Sharing

Copy URL Twitter E-mail

General

Target
534b6c0ec08f77c5a8c3bbcf2abd3e47f380ab70f712979e53e8ce211dd4cc9a
Size 45KB
Sample260718-ttll7sax6t
SHA256 534b6c0ec08f77c5a8c3bbcf2abd3e47f380ab70f712979e53e8ce211dd4cc9a
MD5 2a1766660e8a87726cadb086a036eb8b
SHA1 bd1848c0d72af368ef0f04db3af566e0511cbcb9
SHA512 4803b64193d121a5f331b729c714cb57f71af168f99353a9e3a716abea5160f491b47af2f3963f6565a5aa70ce80a4e2597fd0d0257ef0b649bcf232af9867b4
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1UxGZGP9HuPI5zjbvgu3ivCMtga0u3tK+BDZUx:cu6YepTPso2VGa353bYuSZx5dUx
TLSH
T135232B003BE9C22BF2BE4FB8A8F26105467AF5677603D64D1CC451DB5613FC686426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chichgai.one:80
chichgai.one:22
chichgai.one:8080
chichgai.one:8880
chichgai.one:2052
chichgai.one:2082
chichgai.one:2086
chichgai.one:2095
chichgai.one:443
chichgai.one:2053
chichgai.one:2083
chichgai.one:2087
chichgai.one:2096
chichgai.one:8443
www.chichgai.one:80
www.chichgai.one:22
www.chichgai.one:8080
www.chichgai.one:8880
www.chichgai.one:2052
www.chichgai.one:2082
www.chichgai.one:2086
www.chichgai.one:2095
www.chichgai.one:443
www.chichgai.one:2053
www.chichgai.one:2083
www.chichgai.one:2087
www.chichgai.one:2096
www.chichgai.one:8443
ursnif.chichgai.one:80
ursnif.chichgai.one:22
ursnif.chichgai.one:8080
ursnif.chichgai.one:8880
ursnif.chichgai.one:2052
ursnif.chichgai.one:2082
ursnif.chichgai.one:2086
ursnif.chichgai.one:2095
ursnif.chichgai.one:443
ursnif.chichgai.one:2053
ursnif.chichgai.one:2083
ursnif.chichgai.one:2087
ursnif.chichgai.one:2096
ursnif.chichgai.one:8443
trisis.chichgai.one:80
trisis.chichgai.one:22
trisis.chichgai.one:8080
trisis.chichgai.one:8880
trisis.chichgai.one:2052
trisis.chichgai.one:2082
trisis.chichgai.one:2086
trisis.chichgai.one:2095
trisis.chichgai.one:443
trisis.chichgai.one:2053
trisis.chichgai.one:2083
trisis.chichgai.one:2087
trisis.chichgai.one:2096
trisis.chichgai.one:8443
dridex.chichgai.one:80
dridex.chichgai.one:22
dridex.chichgai.one:8080
dridex.chichgai.one:8880
dridex.chichgai.one:2052
dridex.chichgai.one:2082
dridex.chichgai.one:2086
dridex.chichgai.one:2095
dridex.chichgai.one:443
dridex.chichgai.one:2053
dridex.chichgai.one:2083
dridex.chichgai.one:2087
dridex.chichgai.one:2096
dridex.chichgai.one:8443
revil.chichgai.one:80
revil.chichgai.one:22
revil.chichgai.one:8080
revil.chichgai.one:8880
revil.chichgai.one:2052
revil.chichgai.one:2082
revil.chichgai.one:2086
revil.chichgai.one:2095
revil.chichgai.one:443
revil.chichgai.one:2053
revil.chichgai.one:2083
revil.chichgai.one:2087
revil.chichgai.one:2096
revil.chichgai.one:8443

Mutex

NaYGSktzHdMn

Attributes

delay
0
install
true
install_file
6ugho60n.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  534b6c0ec08f77c5a8c3bbcf2abd3e47f380ab70f712979e53e8ce211dd4cc9a
- Size 45KB
- SHA256 534b6c0ec08f77c5a8c3bbcf2abd3e47f380ab70f712979e53e8ce211dd4cc9a
- MD5 2a1766660e8a87726cadb086a036eb8b
- SHA1 bd1848c0d72af368ef0f04db3af566e0511cbcb9
- SHA512 4803b64193d121a5f331b729c714cb57f71af168f99353a9e3a716abea5160f491b47af2f3963f6565a5aa70ce80a4e2597fd0d0257ef0b649bcf232af9867b4
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1UxGZGP9HuPI5zjbvgu3ivCMtga0u3tK+BDZUx:cu6YepTPso2VGa353bYuSZx5dUx
- TLSH
  T135232B003BE9C22BF2BE4FB8A8F26105467AF5677603D64D1CC451DB5613FC686426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2