asyncrat | 2ed680ff88fa139b20b67c55daeccdc8978837c5a5297f40b5e76056396e3c9f

Sharing

Copy URL Twitter E-mail

General

Target
2ed680ff88fa139b20b67c55daeccdc8978837c5a5297f40b5e76056396e3c9f
Size 45KB
Sample260816-mggddscf93
SHA256 2ed680ff88fa139b20b67c55daeccdc8978837c5a5297f40b5e76056396e3c9f
MD5 e4dae61183d76c25e61bdfc010474a53
SHA1 11b8d54d232cf9ad32dd02fff5a77fb981fbcd62
SHA512 0b1b997ad9f0cf17ac05fdc1eab7d826d73337f08e0893a53330e23172602fbd55eb512c072365a4f5d46502fd4196e198992f181d92b8ab254d11bd424bace4
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IxJaxMwHuPIvzjbjg63idgdcrowwDBDBm3pBDZW:cu6YepTPso2BeN3v3b86SXowaAdUx
TLSH
T106232A003BE8822BF2BE4FB498F26145867AF5637603D6492CC452DB5713FC6DA426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

streamforester.name:80
streamforester.name:22
streamforester.name:8080
streamforester.name:8880
streamforester.name:2052
streamforester.name:2082
streamforester.name:2086
streamforester.name:2095
streamforester.name:443
streamforester.name:2053
streamforester.name:2083
streamforester.name:2087
streamforester.name:2096
streamforester.name:8443
www.streamforester.name:80
www.streamforester.name:22
www.streamforester.name:8080
www.streamforester.name:8880
www.streamforester.name:2052
www.streamforester.name:2082
www.streamforester.name:2086
www.streamforester.name:2095
www.streamforester.name:443
www.streamforester.name:2053
www.streamforester.name:2083
www.streamforester.name:2087
www.streamforester.name:2096
www.streamforester.name:8443
nanocore.streamforester.name:80
nanocore.streamforester.name:22
nanocore.streamforester.name:8080
nanocore.streamforester.name:8880
nanocore.streamforester.name:2052
nanocore.streamforester.name:2082
nanocore.streamforester.name:2086
nanocore.streamforester.name:2095
nanocore.streamforester.name:443
nanocore.streamforester.name:2053
nanocore.streamforester.name:2083
nanocore.streamforester.name:2087
nanocore.streamforester.name:2096
nanocore.streamforester.name:8443
mydoom.streamforester.name:80
mydoom.streamforester.name:22
mydoom.streamforester.name:8080
mydoom.streamforester.name:8880
mydoom.streamforester.name:2052
mydoom.streamforester.name:2082
mydoom.streamforester.name:2086
mydoom.streamforester.name:2095
mydoom.streamforester.name:443
mydoom.streamforester.name:2053
mydoom.streamforester.name:2083
mydoom.streamforester.name:2087
mydoom.streamforester.name:2096
mydoom.streamforester.name:8443

Mutex

3NQdhQm9s1X1

Attributes

delay
0
install
true
install_file
ch5lttmj.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2ed680ff88fa139b20b67c55daeccdc8978837c5a5297f40b5e76056396e3c9f
- Size 45KB
- SHA256 2ed680ff88fa139b20b67c55daeccdc8978837c5a5297f40b5e76056396e3c9f
- MD5 e4dae61183d76c25e61bdfc010474a53
- SHA1 11b8d54d232cf9ad32dd02fff5a77fb981fbcd62
- SHA512 0b1b997ad9f0cf17ac05fdc1eab7d826d73337f08e0893a53330e23172602fbd55eb512c072365a4f5d46502fd4196e198992f181d92b8ab254d11bd424bace4
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IxJaxMwHuPIvzjbjg63idgdcrowwDBDBm3pBDZW:cu6YepTPso2BeN3v3b86SXowaAdUx
- TLSH
  T106232A003BE8822BF2BE4FB498F26145867AF5637603D6492CC452DB5713FC6DA426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2