asyncrat | fd8addda2b0eeeb9773146cad394d02846e203092c90cdda2afd2ed5fef4d5cd

Sharing

Copy URL Twitter E-mail

General

Target
fd8addda2b0eeeb9773146cad394d02846e203092c90cdda2afd2ed5fef4d5cd
Size 45KB
Sample260816-wts3dstglh
SHA256 fd8addda2b0eeeb9773146cad394d02846e203092c90cdda2afd2ed5fef4d5cd
MD5 5e9a47effe9d098edddd7653233fe709
SHA1 1ff884c32f13b98ac8fea76f6e3dea2906f4eb66
SHA512 eaf93e151ff5cc4ee51c7bdd967c0586393ca89776f101d514a341e048938697d0f6c05c3c679d94255bc6cef7d518e0bc02fd5f821df98130af320cd6409505
SSDEEP 768:juseoZTj4ih7WU7jBbIdmo2qjP3FoDEaOPIyzjbugX3iJOoisFPhKRocuSPBDZdx:jusHZTjR9bM2EKEa3y3bRXSJOYxhK/ZD
TLSH
T1AB230A003BE8822BF2BE4F789DF26145867AF2A36603D5491CC451D75723FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
shamoon.e.streamforester.name:80
shamoon.e.streamforester.name:22
shamoon.e.streamforester.name:8080
shamoon.e.streamforester.name:8880
shamoon.e.streamforester.name:2052
shamoon.e.streamforester.name:2082
shamoon.e.streamforester.name:2086
shamoon.e.streamforester.name:2095
shamoon.e.streamforester.name:443
shamoon.e.streamforester.name:2053
shamoon.e.streamforester.name:2083
shamoon.e.streamforester.name:2087
shamoon.e.streamforester.name:2096
shamoon.e.streamforester.name:8443
conti.e.streamforester.name:80
conti.e.streamforester.name:22
conti.e.streamforester.name:8080
conti.e.streamforester.name:8880
conti.e.streamforester.name:2052
conti.e.streamforester.name:2082
conti.e.streamforester.name:2086
conti.e.streamforester.name:2095
conti.e.streamforester.name:443
conti.e.streamforester.name:2053
conti.e.streamforester.name:2083
conti.e.streamforester.name:2087
conti.e.streamforester.name:2096
conti.e.streamforester.name:8443
melissa.e.streamforester.name:80
melissa.e.streamforester.name:22
melissa.e.streamforester.name:8080
melissa.e.streamforester.name:8880
melissa.e.streamforester.name:2052
melissa.e.streamforester.name:2082
melissa.e.streamforester.name:2086
melissa.e.streamforester.name:2095
melissa.e.streamforester.name:443
melissa.e.streamforester.name:2053
melissa.e.streamforester.name:2083
melissa.e.streamforester.name:2087
melissa.e.streamforester.name:2096
melissa.e.streamforester.name:8443
klez.e.streamforester.name:80
klez.e.streamforester.name:22
klez.e.streamforester.name:8080
klez.e.streamforester.name:8880
klez.e.streamforester.name:2052
klez.e.streamforester.name:2082
klez.e.streamforester.name:2086
klez.e.streamforester.name:2095
klez.e.streamforester.name:443
klez.e.streamforester.name:2053
klez.e.streamforester.name:2083
klez.e.streamforester.name:2087
klez.e.streamforester.name:2096
klez.e.streamforester.name:8443

Mutex

XHwSgpxDDchs

Attributes

delay
0
install
true
install_file
n8fh2.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  fd8addda2b0eeeb9773146cad394d02846e203092c90cdda2afd2ed5fef4d5cd
- Size 45KB
- SHA256 fd8addda2b0eeeb9773146cad394d02846e203092c90cdda2afd2ed5fef4d5cd
- MD5 5e9a47effe9d098edddd7653233fe709
- SHA1 1ff884c32f13b98ac8fea76f6e3dea2906f4eb66
- SHA512 eaf93e151ff5cc4ee51c7bdd967c0586393ca89776f101d514a341e048938697d0f6c05c3c679d94255bc6cef7d518e0bc02fd5f821df98130af320cd6409505
- SSDEEP 768:juseoZTj4ih7WU7jBbIdmo2qjP3FoDEaOPIyzjbugX3iJOoisFPhKRocuSPBDZdx:jusHZTjR9bM2EKEa3y3bRXSJOYxhK/ZD
- TLSH
  T1AB230A003BE8822BF2BE4F789DF26145867AF2A36603D5491CC451D75723FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2