asyncrat | 2bc3982af386f22c5fd4edd1cbe9ea9e77ce0492c9fb0a53760a0d7710140d06

Sharing

Copy URL Twitter E-mail

General

Target
2bc3982af386f22c5fd4edd1cbe9ea9e77ce0492c9fb0a53760a0d7710140d06
Size 45KB
Sample260816-rtrgcazelb
SHA256 2bc3982af386f22c5fd4edd1cbe9ea9e77ce0492c9fb0a53760a0d7710140d06
MD5 740f75391d8efb9a55147953ceaf70df
SHA1 11a8db5d38e9e9f8cdafbaef5685640a21488638
SHA512 c9ba55dbe4cee4205a42d6e443150c832fd3cef9256e814686ca4685f9907be3d2bfe91a912dd731dc3d6edd7b4224953a88f48208fcb6e6187f2c24dd22df39
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvzdAAyPMlL8TfPIMWzjbygX340tugx0Uo6rBDZEx:MuLAZTnbg26lvlL+4MW3b1Xo0tD0sdEx
TLSH
T18F232A003BE8812BF1BE4F78A9F26145467AF6732603D94A1CC451DB5B23FC69A426F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
conficker.e.streamforester.name:80
conficker.e.streamforester.name:22
conficker.e.streamforester.name:8080
conficker.e.streamforester.name:8880
conficker.e.streamforester.name:2052
conficker.e.streamforester.name:2082
conficker.e.streamforester.name:2086
conficker.e.streamforester.name:2095
conficker.e.streamforester.name:443
conficker.e.streamforester.name:2053
conficker.e.streamforester.name:2083
conficker.e.streamforester.name:2087
conficker.e.streamforester.name:2096
conficker.e.streamforester.name:8443
trickbot.e.streamforester.name:80
trickbot.e.streamforester.name:22
trickbot.e.streamforester.name:8080
trickbot.e.streamforester.name:8880
trickbot.e.streamforester.name:2052
trickbot.e.streamforester.name:2082
trickbot.e.streamforester.name:2086
trickbot.e.streamforester.name:2095
trickbot.e.streamforester.name:443
trickbot.e.streamforester.name:2053
trickbot.e.streamforester.name:2083
trickbot.e.streamforester.name:2087
trickbot.e.streamforester.name:2096
trickbot.e.streamforester.name:8443

Mutex

Nz5zYsluZiXc

Attributes

delay
0
install
true
install_file
ovwvr.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2bc3982af386f22c5fd4edd1cbe9ea9e77ce0492c9fb0a53760a0d7710140d06
- Size 45KB
- SHA256 2bc3982af386f22c5fd4edd1cbe9ea9e77ce0492c9fb0a53760a0d7710140d06
- MD5 740f75391d8efb9a55147953ceaf70df
- SHA1 11a8db5d38e9e9f8cdafbaef5685640a21488638
- SHA512 c9ba55dbe4cee4205a42d6e443150c832fd3cef9256e814686ca4685f9907be3d2bfe91a912dd731dc3d6edd7b4224953a88f48208fcb6e6187f2c24dd22df39
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvzdAAyPMlL8TfPIMWzjbygX340tugx0Uo6rBDZEx:MuLAZTnbg26lvlL+4MW3b1Xo0tD0sdEx
- TLSH
  T18F232A003BE8812BF1BE4F78A9F26145467AF6732603D94A1CC451DB5B23FC69A426F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2