asyncrat | 1ba0ca2b4344506dfe8b47770ebfc188c24212ac784ce581edb9fd3a70f519e6

Sharing

Copy URL Twitter E-mail

General

Target
1ba0ca2b4344506dfe8b47770ebfc188c24212ac784ce581edb9fd3a70f519e6
Size 45KB
Sample260816-pzapnsdd44
SHA256 1ba0ca2b4344506dfe8b47770ebfc188c24212ac784ce581edb9fd3a70f519e6
MD5 a5a23636459c4036dde15ddf90300276
SHA1 6e9a8bbb27d53dc842b25eb9f7babfce8568f68a
SHA512 153aae09ea4a10e675f94ff7d7f7b2bad6adcc489bb7db86c335181e9866155bf29e4e011d458942b0ca3d0670a166a01a0155df9a831e0416c70bae8266625c
SSDEEP 768:IuI6epTroGtXWU/jmRmo2qTD9wScq/z1OPIszjbEg/3iQRafnhxHk7TbgHhBDZFx:IuIjpTrlO2oi9K3s3bL/S0afhxHeb4fJ
TLSH
T128233B003BEDC12BF2BE8FB499F26105867AF6633603DA491CC451DB5613BC68A526FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
blacklotus.e.streamforester.name:80
blacklotus.e.streamforester.name:22
blacklotus.e.streamforester.name:8080
blacklotus.e.streamforester.name:8880
blacklotus.e.streamforester.name:2052
blacklotus.e.streamforester.name:2082
blacklotus.e.streamforester.name:2086
blacklotus.e.streamforester.name:2095
blacklotus.e.streamforester.name:443
blacklotus.e.streamforester.name:2053
blacklotus.e.streamforester.name:2083
blacklotus.e.streamforester.name:2087
blacklotus.e.streamforester.name:2096
blacklotus.e.streamforester.name:8443
downadup.e.streamforester.name:80
downadup.e.streamforester.name:22
downadup.e.streamforester.name:8080
downadup.e.streamforester.name:8880
downadup.e.streamforester.name:2052
downadup.e.streamforester.name:2082
downadup.e.streamforester.name:2086
downadup.e.streamforester.name:2095
downadup.e.streamforester.name:443
downadup.e.streamforester.name:2053
downadup.e.streamforester.name:2083
downadup.e.streamforester.name:2087
downadup.e.streamforester.name:2096
downadup.e.streamforester.name:8443
cl0p.e.streamforester.name:80
cl0p.e.streamforester.name:22
cl0p.e.streamforester.name:8080
cl0p.e.streamforester.name:8880
cl0p.e.streamforester.name:2052
cl0p.e.streamforester.name:2082
cl0p.e.streamforester.name:2086
cl0p.e.streamforester.name:2095
cl0p.e.streamforester.name:443
cl0p.e.streamforester.name:2053
cl0p.e.streamforester.name:2083
cl0p.e.streamforester.name:2087
cl0p.e.streamforester.name:2096
cl0p.e.streamforester.name:8443
triton.e.streamforester.name:80
triton.e.streamforester.name:22
triton.e.streamforester.name:8080
triton.e.streamforester.name:8880
triton.e.streamforester.name:2052
triton.e.streamforester.name:2082
triton.e.streamforester.name:2086
triton.e.streamforester.name:2095
triton.e.streamforester.name:443
triton.e.streamforester.name:2053
triton.e.streamforester.name:2083
triton.e.streamforester.name:2087
triton.e.streamforester.name:2096
triton.e.streamforester.name:8443

Mutex

RkOKIJjrAFiI

Attributes

delay
0
install
true
install_file
7vziv6l.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1ba0ca2b4344506dfe8b47770ebfc188c24212ac784ce581edb9fd3a70f519e6
- Size 45KB
- SHA256 1ba0ca2b4344506dfe8b47770ebfc188c24212ac784ce581edb9fd3a70f519e6
- MD5 a5a23636459c4036dde15ddf90300276
- SHA1 6e9a8bbb27d53dc842b25eb9f7babfce8568f68a
- SHA512 153aae09ea4a10e675f94ff7d7f7b2bad6adcc489bb7db86c335181e9866155bf29e4e011d458942b0ca3d0670a166a01a0155df9a831e0416c70bae8266625c
- SSDEEP 768:IuI6epTroGtXWU/jmRmo2qTD9wScq/z1OPIszjbEg/3iQRafnhxHk7TbgHhBDZFx:IuIjpTrlO2oi9K3s3bL/S0afhxHeb4fJ
- TLSH
  T128233B003BEDC12BF2BE8FB499F26105867AF6633603DA491CC451DB5613BC68A526FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2