asyncrat | 69062d7fd8d82c67f7cbef30b3f14c5aebe326a7c4bc8f89b06cd36f0c9cee23

Sharing

Copy URL Twitter E-mail

General

Target
69062d7fd8d82c67f7cbef30b3f14c5aebe326a7c4bc8f89b06cd36f0c9cee23
Size 45KB
Sample260815-nb5z8sv1ex
SHA256 69062d7fd8d82c67f7cbef30b3f14c5aebe326a7c4bc8f89b06cd36f0c9cee23
MD5 74d88d3f1adc66e4bd23a4ddc70b8712
SHA1 5f5bba7e631773aa2de95e71e44a620d0c16f8e5
SHA512 8a2830ca0a24fe097edf842dbb8bfefd5ad81704a57f6b104af694be7f1706de3f027f04d08aaae992f992ed076b3cfcb041fead130a3e25c0ae0264263e6045
SSDEEP 768:IuI6epTroGtXWU/jmRmo2qTzS7synzuOPIzzjbmgXZiKQ6lsltDBDZFx:IuIjpTrlO2oSYh3z3b5XoEKvdFx
TLSH
T1DF233B003BE9C12BF2BF4F78A9F26145467AE2637603D6492CC451975713FC28A52AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
codered.e.streamforester.name:80
codered.e.streamforester.name:22
codered.e.streamforester.name:8080
codered.e.streamforester.name:8880
codered.e.streamforester.name:2052
codered.e.streamforester.name:2082
codered.e.streamforester.name:2086
codered.e.streamforester.name:2095
codered.e.streamforester.name:443
codered.e.streamforester.name:2053
codered.e.streamforester.name:2083
codered.e.streamforester.name:2087
codered.e.streamforester.name:2096
codered.e.streamforester.name:8443
remote.e.streamforester.name:80
remote.e.streamforester.name:22
remote.e.streamforester.name:8080
remote.e.streamforester.name:8880
remote.e.streamforester.name:2052
remote.e.streamforester.name:2082
remote.e.streamforester.name:2086
remote.e.streamforester.name:2095
remote.e.streamforester.name:443
remote.e.streamforester.name:2053
remote.e.streamforester.name:2083
remote.e.streamforester.name:2087
remote.e.streamforester.name:2096
remote.e.streamforester.name:8443
clop.e.streamforester.name:80
clop.e.streamforester.name:22
clop.e.streamforester.name:8080
clop.e.streamforester.name:8880
clop.e.streamforester.name:2052
clop.e.streamforester.name:2082
clop.e.streamforester.name:2086
clop.e.streamforester.name:2095
clop.e.streamforester.name:443
clop.e.streamforester.name:2053
clop.e.streamforester.name:2083
clop.e.streamforester.name:2087
clop.e.streamforester.name:2096
clop.e.streamforester.name:8443
socgholish.e.streamforester.name:80
socgholish.e.streamforester.name:22
socgholish.e.streamforester.name:8080
socgholish.e.streamforester.name:8880
socgholish.e.streamforester.name:2052
socgholish.e.streamforester.name:2082
socgholish.e.streamforester.name:2086
socgholish.e.streamforester.name:2095
socgholish.e.streamforester.name:443
socgholish.e.streamforester.name:2053
socgholish.e.streamforester.name:2083
socgholish.e.streamforester.name:2087
socgholish.e.streamforester.name:2096
socgholish.e.streamforester.name:8443

Mutex

Y8prqkrKMOHF

Attributes

delay
0
install
true
install_file
tbayxgo.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  69062d7fd8d82c67f7cbef30b3f14c5aebe326a7c4bc8f89b06cd36f0c9cee23
- Size 45KB
- SHA256 69062d7fd8d82c67f7cbef30b3f14c5aebe326a7c4bc8f89b06cd36f0c9cee23
- MD5 74d88d3f1adc66e4bd23a4ddc70b8712
- SHA1 5f5bba7e631773aa2de95e71e44a620d0c16f8e5
- SHA512 8a2830ca0a24fe097edf842dbb8bfefd5ad81704a57f6b104af694be7f1706de3f027f04d08aaae992f992ed076b3cfcb041fead130a3e25c0ae0264263e6045
- SSDEEP 768:IuI6epTroGtXWU/jmRmo2qTzS7synzuOPIzzjbmgXZiKQ6lsltDBDZFx:IuIjpTrlO2oSYh3z3b5XoEKvdFx
- TLSH
  T1DF233B003BE9C12BF2BF4F78A9F26145467AE2637603D6492CC451975713FC28A52AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2