asyncrat | a4053d91c8df2839a42ecbf959d8fcf8133d21c8063182073daf655011598c1f

Sharing

Copy URL Twitter E-mail

General

Target
a4053d91c8df2839a42ecbf959d8fcf8133d21c8063182073daf655011598c1f
Size 45KB
Sample260817-vkzyxavepc
SHA256 a4053d91c8df2839a42ecbf959d8fcf8133d21c8063182073daf655011598c1f
MD5 16e5b497b5e27e859338bcd987c5176f
SHA1 e455d2af7a27e3b3ee7839798ea527de42d66ca4
SHA512 cf14cb3698c2f3f7b8df38496e2d6f3b007dca0f362807558dc6aba57473e607196cbef3ec71f995413b1d060e4fad7b9e8dc599d50dac5237d5de4068b62cf0
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7JdR3aI6OPIuzjbygx3i+VlBziJBDZ8x:0ushJTDXgH2ojqb3u3b1xS+PWd8x
TLSH
T106232B0037E8812BF2BE4F78ACF26245467AF6777602E64D1CC4419B5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
gozi.e.streamforester.name:80
gozi.e.streamforester.name:22
gozi.e.streamforester.name:8080
gozi.e.streamforester.name:8880
gozi.e.streamforester.name:2052
gozi.e.streamforester.name:2082
gozi.e.streamforester.name:2086
gozi.e.streamforester.name:2095
gozi.e.streamforester.name:443
gozi.e.streamforester.name:2053
gozi.e.streamforester.name:2083
gozi.e.streamforester.name:2087
gozi.e.streamforester.name:2096
gozi.e.streamforester.name:8443
codered.e.streamforester.name:80
codered.e.streamforester.name:22
codered.e.streamforester.name:8080
codered.e.streamforester.name:8880
codered.e.streamforester.name:2052
codered.e.streamforester.name:2082
codered.e.streamforester.name:2086
codered.e.streamforester.name:2095
codered.e.streamforester.name:443
codered.e.streamforester.name:2053
codered.e.streamforester.name:2083
codered.e.streamforester.name:2087
codered.e.streamforester.name:2096
codered.e.streamforester.name:8443
ursnif.e.streamforester.name:80
ursnif.e.streamforester.name:22
ursnif.e.streamforester.name:8080
ursnif.e.streamforester.name:8880
ursnif.e.streamforester.name:2052
ursnif.e.streamforester.name:2082
ursnif.e.streamforester.name:2086
ursnif.e.streamforester.name:2095
ursnif.e.streamforester.name:443
ursnif.e.streamforester.name:2053
ursnif.e.streamforester.name:2083
ursnif.e.streamforester.name:2087
ursnif.e.streamforester.name:2096
ursnif.e.streamforester.name:8443

Mutex

RHfU0Xngytyd

Attributes

delay
0
install
true
install_file
p1i90i.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a4053d91c8df2839a42ecbf959d8fcf8133d21c8063182073daf655011598c1f
- Size 45KB
- SHA256 a4053d91c8df2839a42ecbf959d8fcf8133d21c8063182073daf655011598c1f
- MD5 16e5b497b5e27e859338bcd987c5176f
- SHA1 e455d2af7a27e3b3ee7839798ea527de42d66ca4
- SHA512 cf14cb3698c2f3f7b8df38496e2d6f3b007dca0f362807558dc6aba57473e607196cbef3ec71f995413b1d060e4fad7b9e8dc599d50dac5237d5de4068b62cf0
- SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7JdR3aI6OPIuzjbygx3i+VlBziJBDZ8x:0ushJTDXgH2ojqb3u3b1xS+PWd8x
- TLSH
  T106232B0037E8812BF2BE4F78ACF26245467AF6777602E64D1CC4419B5613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2