asyncrat | fc1a1dc63c91a0bc57762b06ff10a2cb5cd93f9d9790d1ea91437667923de3ce

Sharing

Copy URL Twitter E-mail

General

Target
fc1a1dc63c91a0bc57762b06ff10a2cb5cd93f9d9790d1ea91437667923de3ce
Size 45KB
Sample260816-wxd3msvsb1
SHA256 fc1a1dc63c91a0bc57762b06ff10a2cb5cd93f9d9790d1ea91437667923de3ce
MD5 4c11a29b088b3136b73f03a66f9753f7
SHA1 d2fabb322cb989bf97522fef5f986dbc04d55eb5
SHA512 e79fed788849f5f6e009088657ea96e2190dc6fdc61b014cf8dfddec0f56f4fb42ad6ca5f0bbc3c749a5d757340dcee2a593a1188ae57c7cc4c019dbe1e414bb
SSDEEP 768:ju4dNJTbXcZz1WUBHCjmo2qrG8V1RpPEcPIMzjbigX3imFPRZFmpBDZdx:ju4dNJTjOK2L8VDZEhM3bFXSmFPRC3db
TLSH
T130232B0037E9812BF27E4FB8ADF26145867AF2632603D94A1CC441DB5623FC6C6526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

streamforester.name:80
streamforester.name:22
streamforester.name:8080
streamforester.name:8880
streamforester.name:2052
streamforester.name:2082
streamforester.name:2086
streamforester.name:2095
streamforester.name:443
streamforester.name:2053
streamforester.name:2083
streamforester.name:2087
streamforester.name:2096
streamforester.name:8443
www.streamforester.name:80
www.streamforester.name:22
www.streamforester.name:8080
www.streamforester.name:8880
www.streamforester.name:2052
www.streamforester.name:2082
www.streamforester.name:2086
www.streamforester.name:2095
www.streamforester.name:443
www.streamforester.name:2053
www.streamforester.name:2083
www.streamforester.name:2087
www.streamforester.name:2096
www.streamforester.name:8443
malware.streamforester.name:80
malware.streamforester.name:22
malware.streamforester.name:8080
malware.streamforester.name:8880
malware.streamforester.name:2052
malware.streamforester.name:2082
malware.streamforester.name:2086
malware.streamforester.name:2095
malware.streamforester.name:443
malware.streamforester.name:2053
malware.streamforester.name:2083
malware.streamforester.name:2087
malware.streamforester.name:2096
malware.streamforester.name:8443
cryptolocker.streamforester.name:80
cryptolocker.streamforester.name:22
cryptolocker.streamforester.name:8080
cryptolocker.streamforester.name:8880
cryptolocker.streamforester.name:2052
cryptolocker.streamforester.name:2082
cryptolocker.streamforester.name:2086
cryptolocker.streamforester.name:2095
cryptolocker.streamforester.name:443
cryptolocker.streamforester.name:2053
cryptolocker.streamforester.name:2083
cryptolocker.streamforester.name:2087
cryptolocker.streamforester.name:2096
cryptolocker.streamforester.name:8443
industroyer.streamforester.name:80
industroyer.streamforester.name:22
industroyer.streamforester.name:8080
industroyer.streamforester.name:8880
industroyer.streamforester.name:2052
industroyer.streamforester.name:2082
industroyer.streamforester.name:2086
industroyer.streamforester.name:2095
industroyer.streamforester.name:443
industroyer.streamforester.name:2053
industroyer.streamforester.name:2083
industroyer.streamforester.name:2087
industroyer.streamforester.name:2096
industroyer.streamforester.name:8443
locky.streamforester.name:80
locky.streamforester.name:22
locky.streamforester.name:8080
locky.streamforester.name:8880
locky.streamforester.name:2052
locky.streamforester.name:2082
locky.streamforester.name:2086
locky.streamforester.name:2095
locky.streamforester.name:443
locky.streamforester.name:2053
locky.streamforester.name:2083
locky.streamforester.name:2087
locky.streamforester.name:2096
locky.streamforester.name:8443

Mutex

Xqdb46UkwliO

Attributes

delay
0
install
true
install_file
ksku.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  fc1a1dc63c91a0bc57762b06ff10a2cb5cd93f9d9790d1ea91437667923de3ce
- Size 45KB
- SHA256 fc1a1dc63c91a0bc57762b06ff10a2cb5cd93f9d9790d1ea91437667923de3ce
- MD5 4c11a29b088b3136b73f03a66f9753f7
- SHA1 d2fabb322cb989bf97522fef5f986dbc04d55eb5
- SHA512 e79fed788849f5f6e009088657ea96e2190dc6fdc61b014cf8dfddec0f56f4fb42ad6ca5f0bbc3c749a5d757340dcee2a593a1188ae57c7cc4c019dbe1e414bb
- SSDEEP 768:ju4dNJTbXcZz1WUBHCjmo2qrG8V1RpPEcPIMzjbigX3imFPRZFmpBDZdx:ju4dNJTjOK2L8VDZEhM3bFXSmFPRC3db
- TLSH
  T130232B0037E9812BF27E4FB8ADF26145867AF2632603D94A1CC441DB5623FC6C6526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2