asyncrat | fd907f45a6796ed05da40e4d4bedb10b36095805cc247e9e97f7b2a37c3268c8

Sharing

Copy URL Twitter E-mail

General

Target
fd907f45a6796ed05da40e4d4bedb10b36095805cc247e9e97f7b2a37c3268c8
Size 45KB
Sample260816-par8esxcna
SHA256 fd907f45a6796ed05da40e4d4bedb10b36095805cc247e9e97f7b2a37c3268c8
MD5 6415d15e61fed1e9755a1ee96939a8c6
SHA1 4c658739393837d3b5b0870a5b5799d62cdfd137
SHA512 49a5207f63c9f833d0068943990bf7d119249001e46c70dfcbd482f5752c86854ddeb3c2f60cdb95b095e8e2e36689a79600ffa82dc757a7eda15581c7a0e052
SSDEEP 768:IuuZ5TbUo/BWUlf+DHmo2q7lCSwTMjPIudjbEgX3idoHvhBibVi07DGapqpBDZFx:IuuZ5Tbjst2wg1u1bLXSd8BibV1pYdFx
TLSH
T185231A003BE8812BE2BE4F78A9F26145867AF5673603D58E1CC441DB5B13FC696426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
industroyer.e.streamforester.name:80
industroyer.e.streamforester.name:22
industroyer.e.streamforester.name:8080
industroyer.e.streamforester.name:8880
industroyer.e.streamforester.name:2052
industroyer.e.streamforester.name:2082
industroyer.e.streamforester.name:2086
industroyer.e.streamforester.name:2095
industroyer.e.streamforester.name:443
industroyer.e.streamforester.name:2053
industroyer.e.streamforester.name:2083
industroyer.e.streamforester.name:2087
industroyer.e.streamforester.name:2096
industroyer.e.streamforester.name:8443
malware.e.streamforester.name:80
malware.e.streamforester.name:22
malware.e.streamforester.name:8080
malware.e.streamforester.name:8880
malware.e.streamforester.name:2052
malware.e.streamforester.name:2082
malware.e.streamforester.name:2086
malware.e.streamforester.name:2095
malware.e.streamforester.name:443
malware.e.streamforester.name:2053
malware.e.streamforester.name:2083
malware.e.streamforester.name:2087
malware.e.streamforester.name:2096
malware.e.streamforester.name:8443
mirai.e.streamforester.name:80
mirai.e.streamforester.name:22
mirai.e.streamforester.name:8080
mirai.e.streamforester.name:8880
mirai.e.streamforester.name:2052
mirai.e.streamforester.name:2082
mirai.e.streamforester.name:2086
mirai.e.streamforester.name:2095
mirai.e.streamforester.name:443
mirai.e.streamforester.name:2053
mirai.e.streamforester.name:2083
mirai.e.streamforester.name:2087
mirai.e.streamforester.name:2096
mirai.e.streamforester.name:8443
mydoom.e.streamforester.name:80
mydoom.e.streamforester.name:22
mydoom.e.streamforester.name:8080
mydoom.e.streamforester.name:8880
mydoom.e.streamforester.name:2052
mydoom.e.streamforester.name:2082
mydoom.e.streamforester.name:2086
mydoom.e.streamforester.name:2095
mydoom.e.streamforester.name:443
mydoom.e.streamforester.name:2053
mydoom.e.streamforester.name:2083
mydoom.e.streamforester.name:2087
mydoom.e.streamforester.name:2096
mydoom.e.streamforester.name:8443

Mutex

9uCDETvtTVpI

Attributes

delay
0
install
true
install_file
ntzh88.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  fd907f45a6796ed05da40e4d4bedb10b36095805cc247e9e97f7b2a37c3268c8
- Size 45KB
- SHA256 fd907f45a6796ed05da40e4d4bedb10b36095805cc247e9e97f7b2a37c3268c8
- MD5 6415d15e61fed1e9755a1ee96939a8c6
- SHA1 4c658739393837d3b5b0870a5b5799d62cdfd137
- SHA512 49a5207f63c9f833d0068943990bf7d119249001e46c70dfcbd482f5752c86854ddeb3c2f60cdb95b095e8e2e36689a79600ffa82dc757a7eda15581c7a0e052
- SSDEEP 768:IuuZ5TbUo/BWUlf+DHmo2q7lCSwTMjPIudjbEgX3idoHvhBibVi07DGapqpBDZFx:IuuZ5Tbjst2wg1u1bLXSd8BibV1pYdFx
- TLSH
  T185231A003BE8812BE2BE4F78A9F26145867AF5673603D58E1CC441DB5B13FC696426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2