asyncrat | b73d4fe31c0a89c4d387932e4a36093b6e10e50d1aec6d355c9b45619f4d150e

Sharing

Copy URL Twitter E-mail

General

Target
b73d4fe31c0a89c4d387932e4a36093b6e10e50d1aec6d355c9b45619f4d150e
Size 45KB
Sample260816-ttxpgastbz
SHA256 b73d4fe31c0a89c4d387932e4a36093b6e10e50d1aec6d355c9b45619f4d150e
MD5 d60c7d60d876f5801682fa13523a8e41
SHA1 b2593be404948aa81435ef9f3f1d6ef8ca8b179d
SHA512 8dddbfe5f7324281f2160a9ab6a7d2e2b572358536943169a778d04a64d571cdf0cc4d87ac02872e6ea5ec410f4c9394fc1c361fd0937b8b4425e7931a7f934d
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHBlte40WMOPI0IzjbagXJi0/peM5thS9a3qBDZEx:MuLAZTnbg202UM30I3bNX48p38dEx
TLSH
T1AD231B003BE8C12BF2BE9F78A8F26145467AF6636603D64A1CC452DB4713FC696426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

streamforester.name:80
streamforester.name:22
streamforester.name:8080
streamforester.name:8880
streamforester.name:2052
streamforester.name:2082
streamforester.name:2086
streamforester.name:2095
streamforester.name:443
streamforester.name:2053
streamforester.name:2083
streamforester.name:2087
streamforester.name:2096
streamforester.name:8443
www.streamforester.name:80
www.streamforester.name:22
www.streamforester.name:8080
www.streamforester.name:8880
www.streamforester.name:2052
www.streamforester.name:2082
www.streamforester.name:2086
www.streamforester.name:2095
www.streamforester.name:443
www.streamforester.name:2053
www.streamforester.name:2083
www.streamforester.name:2087
www.streamforester.name:2096
www.streamforester.name:8443
sobig.streamforester.name:80
sobig.streamforester.name:22
sobig.streamforester.name:8080
sobig.streamforester.name:8880
sobig.streamforester.name:2052
sobig.streamforester.name:2082
sobig.streamforester.name:2086
sobig.streamforester.name:2095
sobig.streamforester.name:443
sobig.streamforester.name:2053
sobig.streamforester.name:2083
sobig.streamforester.name:2087
sobig.streamforester.name:2096
sobig.streamforester.name:8443
mydoom.streamforester.name:80
mydoom.streamforester.name:22
mydoom.streamforester.name:8080
mydoom.streamforester.name:8880
mydoom.streamforester.name:2052
mydoom.streamforester.name:2082
mydoom.streamforester.name:2086
mydoom.streamforester.name:2095
mydoom.streamforester.name:443
mydoom.streamforester.name:2053
mydoom.streamforester.name:2083
mydoom.streamforester.name:2087
mydoom.streamforester.name:2096
mydoom.streamforester.name:8443

Mutex

p44QKRIQeDMa

Attributes

delay
0
install
true
install_file
apawo.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b73d4fe31c0a89c4d387932e4a36093b6e10e50d1aec6d355c9b45619f4d150e
- Size 45KB
- SHA256 b73d4fe31c0a89c4d387932e4a36093b6e10e50d1aec6d355c9b45619f4d150e
- MD5 d60c7d60d876f5801682fa13523a8e41
- SHA1 b2593be404948aa81435ef9f3f1d6ef8ca8b179d
- SHA512 8dddbfe5f7324281f2160a9ab6a7d2e2b572358536943169a778d04a64d571cdf0cc4d87ac02872e6ea5ec410f4c9394fc1c361fd0937b8b4425e7931a7f934d
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHBlte40WMOPI0IzjbagXJi0/peM5thS9a3qBDZEx:MuLAZTnbg202UM30I3bNX48p38dEx
- TLSH
  T1AD231B003BE8C12BF2BE9F78A8F26145467AF6636603D64A1CC452DB4713FC696426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2