asyncrat | a6b51ec19010cf058998990dd9c5a2314f7b1de92272339e77e4ed683d7233c0

Sharing

Copy URL Twitter E-mail

General

Target
a6b51ec19010cf058998990dd9c5a2314f7b1de92272339e77e4ed683d7233c0
Size 45KB
Sample260816-papsasxcmg
SHA256 a6b51ec19010cf058998990dd9c5a2314f7b1de92272339e77e4ed683d7233c0
MD5 27fdd005db74ec2acdbe9727a7410a93
SHA1 3f34afb48079e6a29f3b25d5707e64052649243c
SHA512 2e3c52151c8d242c99bec89cda35ae726208bc3946e9d0ed7c46f78e05568e8e3ccf028ba89e0559936afb7aaa984cb27c634255db6683636320f4b61d9bc09e
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVu8kLyuObvtkjZPICzjb8gXTi7CaD+G4xBDZEx:MuBGJTPho2H8LuyyjWC3bTXO734PdEx
TLSH
T19E232A003BE8812BF2BE4F78A9F26145867AF6737503D64A1CC441DB5713FC68A42AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

streamforester.name:80
streamforester.name:22
streamforester.name:8080
streamforester.name:8880
streamforester.name:2052
streamforester.name:2082
streamforester.name:2086
streamforester.name:2095
streamforester.name:443
streamforester.name:2053
streamforester.name:2083
streamforester.name:2087
streamforester.name:2096
streamforester.name:8443
www.streamforester.name:80
www.streamforester.name:22
www.streamforester.name:8080
www.streamforester.name:8880
www.streamforester.name:2052
www.streamforester.name:2082
www.streamforester.name:2086
www.streamforester.name:2095
www.streamforester.name:443
www.streamforester.name:2053
www.streamforester.name:2083
www.streamforester.name:2087
www.streamforester.name:2096
www.streamforester.name:8443
formbook.streamforester.name:80
formbook.streamforester.name:22
formbook.streamforester.name:8080
formbook.streamforester.name:8880
formbook.streamforester.name:2052
formbook.streamforester.name:2082
formbook.streamforester.name:2086
formbook.streamforester.name:2095
formbook.streamforester.name:443
formbook.streamforester.name:2053
formbook.streamforester.name:2083
formbook.streamforester.name:2087
formbook.streamforester.name:2096
formbook.streamforester.name:8443
remcos.streamforester.name:80
remcos.streamforester.name:22
remcos.streamforester.name:8080
remcos.streamforester.name:8880
remcos.streamforester.name:2052
remcos.streamforester.name:2082
remcos.streamforester.name:2086
remcos.streamforester.name:2095
remcos.streamforester.name:443
remcos.streamforester.name:2053
remcos.streamforester.name:2083
remcos.streamforester.name:2087
remcos.streamforester.name:2096
remcos.streamforester.name:8443

Mutex

cECWX3fv3Wz7

Attributes

delay
0
install
true
install_file
1yuq.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a6b51ec19010cf058998990dd9c5a2314f7b1de92272339e77e4ed683d7233c0
- Size 45KB
- SHA256 a6b51ec19010cf058998990dd9c5a2314f7b1de92272339e77e4ed683d7233c0
- MD5 27fdd005db74ec2acdbe9727a7410a93
- SHA1 3f34afb48079e6a29f3b25d5707e64052649243c
- SHA512 2e3c52151c8d242c99bec89cda35ae726208bc3946e9d0ed7c46f78e05568e8e3ccf028ba89e0559936afb7aaa984cb27c634255db6683636320f4b61d9bc09e
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVu8kLyuObvtkjZPICzjb8gXTi7CaD+G4xBDZEx:MuBGJTPho2H8LuyyjWC3bTXO734PdEx
- TLSH
  T19E232A003BE8812BF2BE4F78A9F26145867AF6737503D64A1CC441DB5713FC68A42AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2