asyncrat | ae49054db40903bd786cde1fb502e88cce11eaa0c63241ef6d64047a6eb9a1aa

Sharing

Copy URL Twitter E-mail

General

Target
ae49054db40903bd786cde1fb502e88cce11eaa0c63241ef6d64047a6eb9a1aa
Size 45KB
Sample260816-psrdvax1gs
SHA256 ae49054db40903bd786cde1fb502e88cce11eaa0c63241ef6d64047a6eb9a1aa
MD5 d3142c5fd8f81ea72e96a38e11e3810a
SHA1 2648327d213319c17c7bfa88fa83de956ded7cea
SHA512 a3f829c62bf138c8c2bb135e19d1bb5a58ab1195545661540ac0c7dea6a8a9c2f7c0f7c8d9d56f8eace8fd52ac1ca30252c0e50d10009c996abb555117c7998c
SSDEEP 768:ju4dNJTbXcZz1WUBHCjmo2qraLiE0yFjrdjYkk8PIuejbtgX3iP/NWZ/qGJdJyBR:ju4dNJTjOK29LBXQBuSb6XSP/UVyddx
TLSH
T1D2231A003BE9812BF2BE4F7499F26145467AF6732603D64D1CC441DB1A13FC69A53AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
gootloader.e.streamforester.name:80
gootloader.e.streamforester.name:22
gootloader.e.streamforester.name:8080
gootloader.e.streamforester.name:8880
gootloader.e.streamforester.name:2052
gootloader.e.streamforester.name:2082
gootloader.e.streamforester.name:2086
gootloader.e.streamforester.name:2095
gootloader.e.streamforester.name:443
gootloader.e.streamforester.name:2053
gootloader.e.streamforester.name:2083
gootloader.e.streamforester.name:2087
gootloader.e.streamforester.name:2096
gootloader.e.streamforester.name:8443
ursnif.e.streamforester.name:80
ursnif.e.streamforester.name:22
ursnif.e.streamforester.name:8080
ursnif.e.streamforester.name:8880
ursnif.e.streamforester.name:2052
ursnif.e.streamforester.name:2082
ursnif.e.streamforester.name:2086
ursnif.e.streamforester.name:2095
ursnif.e.streamforester.name:443
ursnif.e.streamforester.name:2053
ursnif.e.streamforester.name:2083
ursnif.e.streamforester.name:2087
ursnif.e.streamforester.name:2096
ursnif.e.streamforester.name:8443
qakbot.e.streamforester.name:80
qakbot.e.streamforester.name:22
qakbot.e.streamforester.name:8080
qakbot.e.streamforester.name:8880
qakbot.e.streamforester.name:2052
qakbot.e.streamforester.name:2082
qakbot.e.streamforester.name:2086
qakbot.e.streamforester.name:2095
qakbot.e.streamforester.name:443
qakbot.e.streamforester.name:2053
qakbot.e.streamforester.name:2083
qakbot.e.streamforester.name:2087
qakbot.e.streamforester.name:2096
qakbot.e.streamforester.name:8443
shamoon.e.streamforester.name:80
shamoon.e.streamforester.name:22
shamoon.e.streamforester.name:8080
shamoon.e.streamforester.name:8880
shamoon.e.streamforester.name:2052
shamoon.e.streamforester.name:2082
shamoon.e.streamforester.name:2086
shamoon.e.streamforester.name:2095
shamoon.e.streamforester.name:443
shamoon.e.streamforester.name:2053
shamoon.e.streamforester.name:2083
shamoon.e.streamforester.name:2087
shamoon.e.streamforester.name:2096
shamoon.e.streamforester.name:8443

Mutex

bn6CvwDAYMY7

Attributes

delay
0
install
true
install_file
ie18.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  ae49054db40903bd786cde1fb502e88cce11eaa0c63241ef6d64047a6eb9a1aa
- Size 45KB
- SHA256 ae49054db40903bd786cde1fb502e88cce11eaa0c63241ef6d64047a6eb9a1aa
- MD5 d3142c5fd8f81ea72e96a38e11e3810a
- SHA1 2648327d213319c17c7bfa88fa83de956ded7cea
- SHA512 a3f829c62bf138c8c2bb135e19d1bb5a58ab1195545661540ac0c7dea6a8a9c2f7c0f7c8d9d56f8eace8fd52ac1ca30252c0e50d10009c996abb555117c7998c
- SSDEEP 768:ju4dNJTbXcZz1WUBHCjmo2qraLiE0yFjrdjYkk8PIuejbtgX3iP/NWZ/qGJdJyBR:ju4dNJTjOK29LBXQBuSb6XSP/UVyddx
- TLSH
  T1D2231A003BE9812BF2BE4F7499F26145467AF6732603D64D1CC441DB1A13FC69A53AEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2