asyncrat | 218411654add3bd0f5c0d09d6404308d783625332527d3fabcbaea44c4c84720

Sharing

Copy URL Twitter E-mail

General

Target
218411654add3bd0f5c0d09d6404308d783625332527d3fabcbaea44c4c84720
Size 45KB
Sample260816-wgrnssfa23
SHA256 218411654add3bd0f5c0d09d6404308d783625332527d3fabcbaea44c4c84720
MD5 317fd7345f1f3764ccd3fe0f47250ff3
SHA1 638f9182ce02fe1bdd54acb1bd3e156271f9ce35
SHA512 5cf6063937a737f716c7a42be381038d5434dac1ef5c46f79c6c2f25c2a6eb651c9c694b76445b7ab5b33a1a9f125deab5fe0f66eadae0e474eb9ed3ede3905e
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvLjbAgX3imArV31Z/AWnjn6BDZEx:MuLAZTnbg2Z4EaHvfbnXSmArVlZ/Hjnv
TLSH
T138231A003BE9822BF1BE4B78ACF25145867EF5636603D64D1CC411D75B23FC69A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

streamforester.name:80
streamforester.name:22
streamforester.name:8080
streamforester.name:8880
streamforester.name:2052
streamforester.name:2082
streamforester.name:2086
streamforester.name:2095
streamforester.name:443
streamforester.name:2053
streamforester.name:2083
streamforester.name:2087
streamforester.name:2096
streamforester.name:8443
www.streamforester.name:80
www.streamforester.name:22
www.streamforester.name:8080
www.streamforester.name:8880
www.streamforester.name:2052
www.streamforester.name:2082
www.streamforester.name:2086
www.streamforester.name:2095
www.streamforester.name:443
www.streamforester.name:2053
www.streamforester.name:2083
www.streamforester.name:2087
www.streamforester.name:2096
www.streamforester.name:8443
conficker.streamforester.name:80
conficker.streamforester.name:22
conficker.streamforester.name:8080
conficker.streamforester.name:8880
conficker.streamforester.name:2052
conficker.streamforester.name:2082
conficker.streamforester.name:2086
conficker.streamforester.name:2095
conficker.streamforester.name:443
conficker.streamforester.name:2053
conficker.streamforester.name:2083
conficker.streamforester.name:2087
conficker.streamforester.name:2096
conficker.streamforester.name:8443
gootloader.streamforester.name:80
gootloader.streamforester.name:22
gootloader.streamforester.name:8080
gootloader.streamforester.name:8880
gootloader.streamforester.name:2052
gootloader.streamforester.name:2082
gootloader.streamforester.name:2086
gootloader.streamforester.name:2095
gootloader.streamforester.name:443
gootloader.streamforester.name:2053
gootloader.streamforester.name:2083
gootloader.streamforester.name:2087
gootloader.streamforester.name:2096
gootloader.streamforester.name:8443

Mutex

8x1k0tF3xoWK

Attributes

delay
0
install
true
install_file
yji68.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  218411654add3bd0f5c0d09d6404308d783625332527d3fabcbaea44c4c84720
- Size 45KB
- SHA256 218411654add3bd0f5c0d09d6404308d783625332527d3fabcbaea44c4c84720
- MD5 317fd7345f1f3764ccd3fe0f47250ff3
- SHA1 638f9182ce02fe1bdd54acb1bd3e156271f9ce35
- SHA512 5cf6063937a737f716c7a42be381038d5434dac1ef5c46f79c6c2f25c2a6eb651c9c694b76445b7ab5b33a1a9f125deab5fe0f66eadae0e474eb9ed3ede3905e
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvLjbAgX3imArV31Z/AWnjn6BDZEx:MuLAZTnbg2Z4EaHvfbnXSmArVlZ/Hjnv
- TLSH
  T138231A003BE9822BF1BE4B78ACF25145867EF5636603D64D1CC411D75B23FC69A42AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2