asyncrat | ce190be4c74c318ecc50b8c723e6164abf9e9a586ab39a4fed5242bcdcf6b70b

Sharing

Copy URL Twitter E-mail

General

Target
ce190be4c74c318ecc50b8c723e6164abf9e9a586ab39a4fed5242bcdcf6b70b
Size 45KB
Sample260815-nldzhaar8v
SHA256 ce190be4c74c318ecc50b8c723e6164abf9e9a586ab39a4fed5242bcdcf6b70b
MD5 fd2805de016d26bd45586ef5ad9deeaf
SHA1 67218ac0aeca8a57afaebdcca6bb987dba86f56c
SHA512 62c93c6feabc22b918736d3f8f665f25d0635122e1a0194562f81935b4810417989c922f81b9be89b57f40cf7516e63c70be7dd1328629d36ef8062e87df83f5
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3xY6AZOOPILzjbwg/3i2BB21kAe6BDZEx:MuLAZTnbg2RulO3L3b3/S2pAekdEx
TLSH
T1C8232B003BE8812BF2BE4BB8ADF26145867AF5B37603D54D1CC4519B5613FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
zeus.e.streamforester.name:80
zeus.e.streamforester.name:22
zeus.e.streamforester.name:8080
zeus.e.streamforester.name:8880
zeus.e.streamforester.name:2052
zeus.e.streamforester.name:2082
zeus.e.streamforester.name:2086
zeus.e.streamforester.name:2095
zeus.e.streamforester.name:443
zeus.e.streamforester.name:2053
zeus.e.streamforester.name:2083
zeus.e.streamforester.name:2087
zeus.e.streamforester.name:2096
zeus.e.streamforester.name:8443
gozi.e.streamforester.name:80
gozi.e.streamforester.name:22
gozi.e.streamforester.name:8080
gozi.e.streamforester.name:8880
gozi.e.streamforester.name:2052
gozi.e.streamforester.name:2082
gozi.e.streamforester.name:2086
gozi.e.streamforester.name:2095
gozi.e.streamforester.name:443
gozi.e.streamforester.name:2053
gozi.e.streamforester.name:2083
gozi.e.streamforester.name:2087
gozi.e.streamforester.name:2096
gozi.e.streamforester.name:8443

Mutex

KDLR1KXyBqGQ

Attributes

delay
0
install
true
install_file
rj27k.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  ce190be4c74c318ecc50b8c723e6164abf9e9a586ab39a4fed5242bcdcf6b70b
- Size 45KB
- SHA256 ce190be4c74c318ecc50b8c723e6164abf9e9a586ab39a4fed5242bcdcf6b70b
- MD5 fd2805de016d26bd45586ef5ad9deeaf
- SHA1 67218ac0aeca8a57afaebdcca6bb987dba86f56c
- SHA512 62c93c6feabc22b918736d3f8f665f25d0635122e1a0194562f81935b4810417989c922f81b9be89b57f40cf7516e63c70be7dd1328629d36ef8062e87df83f5
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3xY6AZOOPILzjbwg/3i2BB21kAe6BDZEx:MuLAZTnbg2RulO3L3b3/S2pAekdEx
- TLSH
  T1C8232B003BE8812BF2BE4BB8ADF26145867AF5B37603D54D1CC4519B5613FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2