asyncrat | 37ed961f57ffd9a4dc45fed21109e42375d7466a6c979690f36a570a67cd55d9

Sharing

Copy URL Twitter E-mail

General

Target
37ed961f57ffd9a4dc45fed21109e42375d7466a6c979690f36a570a67cd55d9
Size 45KB
Sample260816-ja9jtabh65
SHA256 37ed961f57ffd9a4dc45fed21109e42375d7466a6c979690f36a570a67cd55d9
MD5 1bd7bbbcfe3082f9f1d238e38757ebdc
SHA1 4d7011fde9f0d6e2ea0e8d333ea986993be7c699
SHA512 e52b3de3e19c31a1f84831a9ba721bbb1422a41f92da440928bc4f448027ad3877fad897a61e4b0771c40affea48dbb2351cb9b5c315bdff80c08924464906f2
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAO8V1RpPEcPIMzjb0gX3iNwVjytKHoQhUYJmCBDZW:cuqNJTLr62e8VDZEhM3bbXSyjyEHoEUF
TLSH
T1A423290037E8822BF2BE4F7899F26146867AF6632603D54D1CC452DB5713FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
blaster.e.streamforester.name:80
blaster.e.streamforester.name:22
blaster.e.streamforester.name:8080
blaster.e.streamforester.name:8880
blaster.e.streamforester.name:2052
blaster.e.streamforester.name:2082
blaster.e.streamforester.name:2086
blaster.e.streamforester.name:2095
blaster.e.streamforester.name:443
blaster.e.streamforester.name:2053
blaster.e.streamforester.name:2083
blaster.e.streamforester.name:2087
blaster.e.streamforester.name:2096
blaster.e.streamforester.name:8443
conficker.e.streamforester.name:80
conficker.e.streamforester.name:22
conficker.e.streamforester.name:8080
conficker.e.streamforester.name:8880
conficker.e.streamforester.name:2052
conficker.e.streamforester.name:2082
conficker.e.streamforester.name:2086
conficker.e.streamforester.name:2095
conficker.e.streamforester.name:443
conficker.e.streamforester.name:2053
conficker.e.streamforester.name:2083
conficker.e.streamforester.name:2087
conficker.e.streamforester.name:2096
conficker.e.streamforester.name:8443
stuxnet.e.streamforester.name:80
stuxnet.e.streamforester.name:22
stuxnet.e.streamforester.name:8080
stuxnet.e.streamforester.name:8880
stuxnet.e.streamforester.name:2052
stuxnet.e.streamforester.name:2082
stuxnet.e.streamforester.name:2086
stuxnet.e.streamforester.name:2095
stuxnet.e.streamforester.name:443
stuxnet.e.streamforester.name:2053
stuxnet.e.streamforester.name:2083
stuxnet.e.streamforester.name:2087
stuxnet.e.streamforester.name:2096
stuxnet.e.streamforester.name:8443

Mutex

Fx6cYJ4mrQjv

Attributes

delay
0
install
true
install_file
b8iu.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  37ed961f57ffd9a4dc45fed21109e42375d7466a6c979690f36a570a67cd55d9
- Size 45KB
- SHA256 37ed961f57ffd9a4dc45fed21109e42375d7466a6c979690f36a570a67cd55d9
- MD5 1bd7bbbcfe3082f9f1d238e38757ebdc
- SHA1 4d7011fde9f0d6e2ea0e8d333ea986993be7c699
- SHA512 e52b3de3e19c31a1f84831a9ba721bbb1422a41f92da440928bc4f448027ad3877fad897a61e4b0771c40affea48dbb2351cb9b5c315bdff80c08924464906f2
- SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAO8V1RpPEcPIMzjb0gX3iNwVjytKHoQhUYJmCBDZW:cuqNJTLr62e8VDZEhM3bbXSyjyEHoEUF
- TLSH
  T1A423290037E8822BF2BE4F7899F26146867AF6632603D54D1CC452DB5713FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2