asyncrat | ec13494cf1cd4548dbc737bdf8e8bdc88dedce74382ca7d02bb66c5c22477524

Sharing

Copy URL Twitter E-mail

General

Target
ec13494cf1cd4548dbc737bdf8e8bdc88dedce74382ca7d02bb66c5c22477524
Size 45KB
Sample260816-ppynraar5y
SHA256 ec13494cf1cd4548dbc737bdf8e8bdc88dedce74382ca7d02bb66c5c22477524
MD5 262e1f95325fdc338d51d14da1432c85
SHA1 6478deaeac7d5b04aa7a5d567e743405094f539a
SHA512 6c5f1d7ace8282ce540d562fc54f07cb34857eecff9e4176901e199621ae55379a77fb0d3bce485788038fe42ecd93442c25a49ef98ee3d3c4a3babccdb5bebb
SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrXT9Qpm9PIgzjbigX3iLmace59IqOyJBDZkx:vuogpT7I62AQg3bFXSKafIhyXdkx
TLSH
T101230A003BE8813BF2BE5FB898F26145867AF6637603D5892CC451D75623BC6CA426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
invasive.e.streamforester.name:80
invasive.e.streamforester.name:22
invasive.e.streamforester.name:8080
invasive.e.streamforester.name:8880
invasive.e.streamforester.name:2052
invasive.e.streamforester.name:2082
invasive.e.streamforester.name:2086
invasive.e.streamforester.name:2095
invasive.e.streamforester.name:443
invasive.e.streamforester.name:2053
invasive.e.streamforester.name:2083
invasive.e.streamforester.name:2087
invasive.e.streamforester.name:2096
invasive.e.streamforester.name:8443
agenttesla.e.streamforester.name:80
agenttesla.e.streamforester.name:22
agenttesla.e.streamforester.name:8080
agenttesla.e.streamforester.name:8880
agenttesla.e.streamforester.name:2052
agenttesla.e.streamforester.name:2082
agenttesla.e.streamforester.name:2086
agenttesla.e.streamforester.name:2095
agenttesla.e.streamforester.name:443
agenttesla.e.streamforester.name:2053
agenttesla.e.streamforester.name:2083
agenttesla.e.streamforester.name:2087
agenttesla.e.streamforester.name:2096
agenttesla.e.streamforester.name:8443
locky.e.streamforester.name:80
locky.e.streamforester.name:22
locky.e.streamforester.name:8080
locky.e.streamforester.name:8880
locky.e.streamforester.name:2052
locky.e.streamforester.name:2082
locky.e.streamforester.name:2086
locky.e.streamforester.name:2095
locky.e.streamforester.name:443
locky.e.streamforester.name:2053
locky.e.streamforester.name:2083
locky.e.streamforester.name:2087
locky.e.streamforester.name:2096
locky.e.streamforester.name:8443

Mutex

DzYLl942EFQw

Attributes

delay
0
install
true
install_file
14312pu4.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  ec13494cf1cd4548dbc737bdf8e8bdc88dedce74382ca7d02bb66c5c22477524
- Size 45KB
- SHA256 ec13494cf1cd4548dbc737bdf8e8bdc88dedce74382ca7d02bb66c5c22477524
- MD5 262e1f95325fdc338d51d14da1432c85
- SHA1 6478deaeac7d5b04aa7a5d567e743405094f539a
- SHA512 6c5f1d7ace8282ce540d562fc54f07cb34857eecff9e4176901e199621ae55379a77fb0d3bce485788038fe42ecd93442c25a49ef98ee3d3c4a3babccdb5bebb
- SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrXT9Qpm9PIgzjbigX3iLmace59IqOyJBDZkx:vuogpT7I62AQg3bFXSKafIhyXdkx
- TLSH
  T101230A003BE8813BF2BE5FB898F26145867AF6637603D5892CC451D75623BC6CA426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2