asyncrat | 1b1f831f54cb998d4c9d8d9d9321991e0dc0058ee0cf884be5d000e550c24528

Sharing

Copy URL Twitter E-mail

General

Target
1b1f831f54cb998d4c9d8d9d9321991e0dc0058ee0cf884be5d000e550c24528
Size 45KB
Sample260816-rerhsszbjf
SHA256 1b1f831f54cb998d4c9d8d9d9321991e0dc0058ee0cf884be5d000e550c24528
MD5 e26a08f4b561efbd56de876a50efa0f7
SHA1 10ba8262ae10256acabf98f69c9efd92ddc4e210
SHA512 2fcc625349e0db0aa9361ce3b4d7bb3a356584b2f7feacadadc3ba4ade7b6f2089593b4292416b7425898bdcc662aa68eb7b379d5057bc0de9cc070429760ed1
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAEuwZQaKkPI7zjbxgX3iWYLm0RPgR8goBDZcx:UuKWgSJTwRf2oI73b+XSW1ogRudcx
TLSH
T116232A103BE8823BF2BE4F7898F26145857AF6632603D94D6CC451DB5623FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
cryptolocker.e.streamforester.name:80
cryptolocker.e.streamforester.name:22
cryptolocker.e.streamforester.name:8080
cryptolocker.e.streamforester.name:8880
cryptolocker.e.streamforester.name:2052
cryptolocker.e.streamforester.name:2082
cryptolocker.e.streamforester.name:2086
cryptolocker.e.streamforester.name:2095
cryptolocker.e.streamforester.name:443
cryptolocker.e.streamforester.name:2053
cryptolocker.e.streamforester.name:2083
cryptolocker.e.streamforester.name:2087
cryptolocker.e.streamforester.name:2096
cryptolocker.e.streamforester.name:8443
codered.e.streamforester.name:80
codered.e.streamforester.name:22
codered.e.streamforester.name:8080
codered.e.streamforester.name:8880
codered.e.streamforester.name:2052
codered.e.streamforester.name:2082
codered.e.streamforester.name:2086
codered.e.streamforester.name:2095
codered.e.streamforester.name:443
codered.e.streamforester.name:2053
codered.e.streamforester.name:2083
codered.e.streamforester.name:2087
codered.e.streamforester.name:2096
codered.e.streamforester.name:8443

Mutex

bEdYwMciyAZF

Attributes

delay
0
install
true
install_file
sxei1l41.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1b1f831f54cb998d4c9d8d9d9321991e0dc0058ee0cf884be5d000e550c24528
- Size 45KB
- SHA256 1b1f831f54cb998d4c9d8d9d9321991e0dc0058ee0cf884be5d000e550c24528
- MD5 e26a08f4b561efbd56de876a50efa0f7
- SHA1 10ba8262ae10256acabf98f69c9efd92ddc4e210
- SHA512 2fcc625349e0db0aa9361ce3b4d7bb3a356584b2f7feacadadc3ba4ade7b6f2089593b4292416b7425898bdcc662aa68eb7b379d5057bc0de9cc070429760ed1
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAEuwZQaKkPI7zjbxgX3iWYLm0RPgR8goBDZcx:UuKWgSJTwRf2oI73b+XSW1ogRudcx
- TLSH
  T116232A103BE8823BF2BE4F7898F26145857AF6632603D94D6CC451DB5623FC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2