asyncrat | 18faa864a29dfa5d173cbf47fcf88c917ebc92f77a30ea4dc8e078aa8432e7a2

Sharing

Copy URL Twitter E-mail

General

Target
18faa864a29dfa5d173cbf47fcf88c917ebc92f77a30ea4dc8e078aa8432e7a2
Size 45KB
Sample260816-g928nsem91
SHA256 18faa864a29dfa5d173cbf47fcf88c917ebc92f77a30ea4dc8e078aa8432e7a2
MD5 52d320a6db1894f0ad7879655f94c626
SHA1 e980a229338a5b658e9b87e7b6fc5e352e6bccff
SHA512 ea55ac0b5d84513a171b9e9ee93dc58ac07114962603ca46161d334939fc8a7554a026bdc0f8fe5de2767d60a3aae60d2759ce8195dc117d0470b44a4421dad2
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1s3wZQaKkPIgzjbBBgX3i3RCItEnqQbBDZUx:cu6YepTPso2QIg3bcXS0ItEbdUx
TLSH
T164232B003BE9C23AF2BE4FB499F26145867AF6633603D54D2CC451DB5623BC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

streamforester.name:80
streamforester.name:22
streamforester.name:8080
streamforester.name:8880
streamforester.name:2052
streamforester.name:2082
streamforester.name:2086
streamforester.name:2095
streamforester.name:443
streamforester.name:2053
streamforester.name:2083
streamforester.name:2087
streamforester.name:2096
streamforester.name:8443
www.streamforester.name:80
www.streamforester.name:22
www.streamforester.name:8080
www.streamforester.name:8880
www.streamforester.name:2052
www.streamforester.name:2082
www.streamforester.name:2086
www.streamforester.name:2095
www.streamforester.name:443
www.streamforester.name:2053
www.streamforester.name:2083
www.streamforester.name:2087
www.streamforester.name:2096
www.streamforester.name:8443
nimda.streamforester.name:80
nimda.streamforester.name:22
nimda.streamforester.name:8080
nimda.streamforester.name:8880
nimda.streamforester.name:2052
nimda.streamforester.name:2082
nimda.streamforester.name:2086
nimda.streamforester.name:2095
nimda.streamforester.name:443
nimda.streamforester.name:2053
nimda.streamforester.name:2083
nimda.streamforester.name:2087
nimda.streamforester.name:2096
nimda.streamforester.name:8443
codered.streamforester.name:80
codered.streamforester.name:22
codered.streamforester.name:8080
codered.streamforester.name:8880
codered.streamforester.name:2052
codered.streamforester.name:2082
codered.streamforester.name:2086
codered.streamforester.name:2095
codered.streamforester.name:443
codered.streamforester.name:2053
codered.streamforester.name:2083
codered.streamforester.name:2087
codered.streamforester.name:2096
codered.streamforester.name:8443

Mutex

ZAivJAJL7zU9

Attributes

delay
0
install
true
install_file
ebcyg270.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  18faa864a29dfa5d173cbf47fcf88c917ebc92f77a30ea4dc8e078aa8432e7a2
- Size 45KB
- SHA256 18faa864a29dfa5d173cbf47fcf88c917ebc92f77a30ea4dc8e078aa8432e7a2
- MD5 52d320a6db1894f0ad7879655f94c626
- SHA1 e980a229338a5b658e9b87e7b6fc5e352e6bccff
- SHA512 ea55ac0b5d84513a171b9e9ee93dc58ac07114962603ca46161d334939fc8a7554a026bdc0f8fe5de2767d60a3aae60d2759ce8195dc117d0470b44a4421dad2
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1s3wZQaKkPIgzjbBBgX3i3RCItEnqQbBDZUx:cu6YepTPso2QIg3bcXS0ItEbdUx
- TLSH
  T164232B003BE9C23AF2BE4FB499F26145867AF6633603D54D2CC451DB5623BC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2