asyncrat | 36b20feced56272ce4447df754f3aaa95c02dbc13fd771bca75b1ae6cded6e11

Sharing

Copy URL Twitter E-mail

General

Target
36b20feced56272ce4447df754f3aaa95c02dbc13fd771bca75b1ae6cded6e11
Size 45KB
Sample260816-yrkpcahn91
SHA256 36b20feced56272ce4447df754f3aaa95c02dbc13fd771bca75b1ae6cded6e11
MD5 6bf8fc56739b91056197881c3a1c843e
SHA1 16212b69947ab91ee2e50aa8608e10740e6d6670
SHA512 9d87b677fe945b765c6d59fa6d773cddb9e893fa07b11a5987fc7148a533ebf245a6a1b323857e15d208479f1b34be81882f9639d672dd7517d0a2a6886d4199
SSDEEP 768:ju4dNJTbXcZz1WUBHCjmo2qrr0b3NLAteiZPImzjbCgz3iNBqYVclnsaVOBDZdx:ju4dNJTjOK2R3ZhiWm3blzSNBqYWltVG
TLSH
T173231B003BE9812BF2BE4F78A8F26145467AF6632603D5891CC451DB5723FC69A43AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
sasser.e.streamforester.name:80
sasser.e.streamforester.name:22
sasser.e.streamforester.name:8080
sasser.e.streamforester.name:8880
sasser.e.streamforester.name:2052
sasser.e.streamforester.name:2082
sasser.e.streamforester.name:2086
sasser.e.streamforester.name:2095
sasser.e.streamforester.name:443
sasser.e.streamforester.name:2053
sasser.e.streamforester.name:2083
sasser.e.streamforester.name:2087
sasser.e.streamforester.name:2096
sasser.e.streamforester.name:8443
remote.e.streamforester.name:80
remote.e.streamforester.name:22
remote.e.streamforester.name:8080
remote.e.streamforester.name:8880
remote.e.streamforester.name:2052
remote.e.streamforester.name:2082
remote.e.streamforester.name:2086
remote.e.streamforester.name:2095
remote.e.streamforester.name:443
remote.e.streamforester.name:2053
remote.e.streamforester.name:2083
remote.e.streamforester.name:2087
remote.e.streamforester.name:2096
remote.e.streamforester.name:8443
downadup.e.streamforester.name:80
downadup.e.streamforester.name:22
downadup.e.streamforester.name:8080
downadup.e.streamforester.name:8880
downadup.e.streamforester.name:2052
downadup.e.streamforester.name:2082
downadup.e.streamforester.name:2086
downadup.e.streamforester.name:2095
downadup.e.streamforester.name:443
downadup.e.streamforester.name:2053
downadup.e.streamforester.name:2083
downadup.e.streamforester.name:2087
downadup.e.streamforester.name:2096
downadup.e.streamforester.name:8443
remcos.e.streamforester.name:80
remcos.e.streamforester.name:22
remcos.e.streamforester.name:8080
remcos.e.streamforester.name:8880
remcos.e.streamforester.name:2052
remcos.e.streamforester.name:2082
remcos.e.streamforester.name:2086
remcos.e.streamforester.name:2095
remcos.e.streamforester.name:443
remcos.e.streamforester.name:2053
remcos.e.streamforester.name:2083
remcos.e.streamforester.name:2087
remcos.e.streamforester.name:2096
remcos.e.streamforester.name:8443

Mutex

cPBrjeOqYFdo

Attributes

delay
0
install
true
install_file
p02l.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  36b20feced56272ce4447df754f3aaa95c02dbc13fd771bca75b1ae6cded6e11
- Size 45KB
- SHA256 36b20feced56272ce4447df754f3aaa95c02dbc13fd771bca75b1ae6cded6e11
- MD5 6bf8fc56739b91056197881c3a1c843e
- SHA1 16212b69947ab91ee2e50aa8608e10740e6d6670
- SHA512 9d87b677fe945b765c6d59fa6d773cddb9e893fa07b11a5987fc7148a533ebf245a6a1b323857e15d208479f1b34be81882f9639d672dd7517d0a2a6886d4199
- SSDEEP 768:ju4dNJTbXcZz1WUBHCjmo2qrr0b3NLAteiZPImzjbCgz3iNBqYVclnsaVOBDZdx:ju4dNJTjOK2R3ZhiWm3blzSNBqYWltVG
- TLSH
  T173231B003BE9812BF2BE4F78A8F26145467AF6632603D5891CC451DB5723FC69A43AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2