asyncrat | 17c6d19030a7b8ab395ffd1067ee0581bba97aa9288e0392ea8f5b6c6a919fae

Sharing

Copy URL Twitter E-mail

General

Target
17c6d19030a7b8ab395ffd1067ee0581bba97aa9288e0392ea8f5b6c6a919fae
Size 45KB
Sample260816-vefcbaef47
SHA256 17c6d19030a7b8ab395ffd1067ee0581bba97aa9288e0392ea8f5b6c6a919fae
MD5 d08ad360b2ba89e6bfd4363329f45f7a
SHA1 e90afcb775d32d27af06114783e32f27a50cc1a7
SHA512 8ef1a993b280dff1aa8140348f7558972b36d57b29fd3d14449de89aafb91c32ecebc6db539d85809876f6a47f0fe5764bee731441baf7437416b9c705d17a5c
SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjLS7synzuOPIzzjb2gX9iJ9g84USo3FkkBDZ8x:0u2vpTDe+2gSYh3z3bpXM4BHSd8x
TLSH
T1E3233A003BE8822BF2BE4FB49CF26145867AF6636603D5492CC452D75713FC68A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
gh0st.e.streamforester.name:80
gh0st.e.streamforester.name:22
gh0st.e.streamforester.name:8080
gh0st.e.streamforester.name:8880
gh0st.e.streamforester.name:2052
gh0st.e.streamforester.name:2082
gh0st.e.streamforester.name:2086
gh0st.e.streamforester.name:2095
gh0st.e.streamforester.name:443
gh0st.e.streamforester.name:2053
gh0st.e.streamforester.name:2083
gh0st.e.streamforester.name:2087
gh0st.e.streamforester.name:2096
gh0st.e.streamforester.name:8443
azorult.e.streamforester.name:80
azorult.e.streamforester.name:22
azorult.e.streamforester.name:8080
azorult.e.streamforester.name:8880
azorult.e.streamforester.name:2052
azorult.e.streamforester.name:2082
azorult.e.streamforester.name:2086
azorult.e.streamforester.name:2095
azorult.e.streamforester.name:443
azorult.e.streamforester.name:2053
azorult.e.streamforester.name:2083
azorult.e.streamforester.name:2087
azorult.e.streamforester.name:2096
azorult.e.streamforester.name:8443
remote.e.streamforester.name:80
remote.e.streamforester.name:22
remote.e.streamforester.name:8080
remote.e.streamforester.name:8880
remote.e.streamforester.name:2052
remote.e.streamforester.name:2082
remote.e.streamforester.name:2086
remote.e.streamforester.name:2095
remote.e.streamforester.name:443
remote.e.streamforester.name:2053
remote.e.streamforester.name:2083
remote.e.streamforester.name:2087
remote.e.streamforester.name:2096
remote.e.streamforester.name:8443

Mutex

S3dd4iOMkzZu

Attributes

delay
0
install
true
install_file
cafx1no.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  17c6d19030a7b8ab395ffd1067ee0581bba97aa9288e0392ea8f5b6c6a919fae
- Size 45KB
- SHA256 17c6d19030a7b8ab395ffd1067ee0581bba97aa9288e0392ea8f5b6c6a919fae
- MD5 d08ad360b2ba89e6bfd4363329f45f7a
- SHA1 e90afcb775d32d27af06114783e32f27a50cc1a7
- SHA512 8ef1a993b280dff1aa8140348f7558972b36d57b29fd3d14449de89aafb91c32ecebc6db539d85809876f6a47f0fe5764bee731441baf7437416b9c705d17a5c
- SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjLS7synzuOPIzzjb2gX9iJ9g84USo3FkkBDZ8x:0u2vpTDe+2gSYh3z3bpXM4BHSd8x
- TLSH
  T1E3233A003BE8822BF2BE4FB49CF26145867AF6636603D5492CC452D75713FC68A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2