asyncrat | 3751677878b1715e30d45b23695d4b064e2bb802a2a1efd456f75fc646f87eff

Sharing

Copy URL Twitter E-mail

General

Target
3751677878b1715e30d45b23695d4b064e2bb802a2a1efd456f75fc646f87eff
Size 45KB
Sample260816-jgqqaaca36
SHA256 3751677878b1715e30d45b23695d4b064e2bb802a2a1efd456f75fc646f87eff
MD5 577f475aa5796d618845b4ada1ee0d91
SHA1 3eeeb118720efa623b60ff396b94f107e5b73bba
SHA512 e925ea7438f03c11aad13b42eda3e4e3eb2b8a15c3ed5f891a3981955d29a5e07f92abd4b2bcb4b0ae14a0e0955d8de4b8f961429886dcd8c0d61600c30d6cb2
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q16pE+VdH8tPIhzjbqgX3iAvJT8O5CWq8BDZUx:cu6YepTPso2zHbh3b9XSAvJo1DadUx
TLSH
T142231A003BE8812BF2BF4FB898F26145867AF5637603D64D2CC451DB5623FC6DA426E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
ursnif.e.streamforester.name:80
ursnif.e.streamforester.name:22
ursnif.e.streamforester.name:8080
ursnif.e.streamforester.name:8880
ursnif.e.streamforester.name:2052
ursnif.e.streamforester.name:2082
ursnif.e.streamforester.name:2086
ursnif.e.streamforester.name:2095
ursnif.e.streamforester.name:443
ursnif.e.streamforester.name:2053
ursnif.e.streamforester.name:2083
ursnif.e.streamforester.name:2087
ursnif.e.streamforester.name:2096
ursnif.e.streamforester.name:8443
cryptolocker.e.streamforester.name:80
cryptolocker.e.streamforester.name:22
cryptolocker.e.streamforester.name:8080
cryptolocker.e.streamforester.name:8880
cryptolocker.e.streamforester.name:2052
cryptolocker.e.streamforester.name:2082
cryptolocker.e.streamforester.name:2086
cryptolocker.e.streamforester.name:2095
cryptolocker.e.streamforester.name:443
cryptolocker.e.streamforester.name:2053
cryptolocker.e.streamforester.name:2083
cryptolocker.e.streamforester.name:2087
cryptolocker.e.streamforester.name:2096
cryptolocker.e.streamforester.name:8443

Mutex

RfWtAH7dMohq

Attributes

delay
0
install
true
install_file
taip4cme.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  3751677878b1715e30d45b23695d4b064e2bb802a2a1efd456f75fc646f87eff
- Size 45KB
- SHA256 3751677878b1715e30d45b23695d4b064e2bb802a2a1efd456f75fc646f87eff
- MD5 577f475aa5796d618845b4ada1ee0d91
- SHA1 3eeeb118720efa623b60ff396b94f107e5b73bba
- SHA512 e925ea7438f03c11aad13b42eda3e4e3eb2b8a15c3ed5f891a3981955d29a5e07f92abd4b2bcb4b0ae14a0e0955d8de4b8f961429886dcd8c0d61600c30d6cb2
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q16pE+VdH8tPIhzjbqgX3iAvJT8O5CWq8BDZUx:cu6YepTPso2zHbh3b9XSAvJo1DadUx
- TLSH
  T142231A003BE8812BF2BF4FB898F26145867AF5637603D64D2CC451DB5623FC6DA426E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2