asyncrat | 4defbdaa0cc8513027c3794ed1d9f29476e586623a20a09e63cb2807a1d10eb9

Sharing

Copy URL Twitter E-mail

General

Target
4defbdaa0cc8513027c3794ed1d9f29476e586623a20a09e63cb2807a1d10eb9
Size 45KB
Sample260817-vmjdyaen7t
SHA256 4defbdaa0cc8513027c3794ed1d9f29476e586623a20a09e63cb2807a1d10eb9
MD5 a61353241156fd3ea4e1961cc896757e
SHA1 1f7539d333ab4566cdff51a3201775c8d34d3cb7
SHA512 323c4849325362dab1e8a722ff42cd47eca505c226a7d8e7e75a16ce63e79db97267e4ba53e69b266ac9a761cc07c7296d9b0a2a858a68bc1182b48637370d80
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4L9Y6kq/zNOPIyzjbKgV3iJSfk6VTg0JEYfBDZ0x:8uUIpT4vAj2Pa9C3y3bdVSJGkKpJBpd2
TLSH
T104232A003BE9C12BF2BE4F78A9F26105867AB5633603D5491CC452DB5B13FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

streamforester.name:80
streamforester.name:22
streamforester.name:8080
streamforester.name:8880
streamforester.name:2052
streamforester.name:2082
streamforester.name:2086
streamforester.name:2095
streamforester.name:443
streamforester.name:2053
streamforester.name:2083
streamforester.name:2087
streamforester.name:2096
streamforester.name:8443
www.streamforester.name:80
www.streamforester.name:22
www.streamforester.name:8080
www.streamforester.name:8880
www.streamforester.name:2052
www.streamforester.name:2082
www.streamforester.name:2086
www.streamforester.name:2095
www.streamforester.name:443
www.streamforester.name:2053
www.streamforester.name:2083
www.streamforester.name:2087
www.streamforester.name:2096
www.streamforester.name:8443
wannacry.streamforester.name:80
wannacry.streamforester.name:22
wannacry.streamforester.name:8080
wannacry.streamforester.name:8880
wannacry.streamforester.name:2052
wannacry.streamforester.name:2082
wannacry.streamforester.name:2086
wannacry.streamforester.name:2095
wannacry.streamforester.name:443
wannacry.streamforester.name:2053
wannacry.streamforester.name:2083
wannacry.streamforester.name:2087
wannacry.streamforester.name:2096
wannacry.streamforester.name:8443
revil.streamforester.name:80
revil.streamforester.name:22
revil.streamforester.name:8080
revil.streamforester.name:8880
revil.streamforester.name:2052
revil.streamforester.name:2082
revil.streamforester.name:2086
revil.streamforester.name:2095
revil.streamforester.name:443
revil.streamforester.name:2053
revil.streamforester.name:2083
revil.streamforester.name:2087
revil.streamforester.name:2096
revil.streamforester.name:8443
stuxnet.streamforester.name:80
stuxnet.streamforester.name:22
stuxnet.streamforester.name:8080
stuxnet.streamforester.name:8880
stuxnet.streamforester.name:2052
stuxnet.streamforester.name:2082
stuxnet.streamforester.name:2086
stuxnet.streamforester.name:2095
stuxnet.streamforester.name:443
stuxnet.streamforester.name:2053
stuxnet.streamforester.name:2083
stuxnet.streamforester.name:2087
stuxnet.streamforester.name:2096
stuxnet.streamforester.name:8443

Mutex

NtmUSYlgRBiM

Attributes

delay
0
install
true
install_file
lkf51yh.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4defbdaa0cc8513027c3794ed1d9f29476e586623a20a09e63cb2807a1d10eb9
- Size 45KB
- SHA256 4defbdaa0cc8513027c3794ed1d9f29476e586623a20a09e63cb2807a1d10eb9
- MD5 a61353241156fd3ea4e1961cc896757e
- SHA1 1f7539d333ab4566cdff51a3201775c8d34d3cb7
- SHA512 323c4849325362dab1e8a722ff42cd47eca505c226a7d8e7e75a16ce63e79db97267e4ba53e69b266ac9a761cc07c7296d9b0a2a858a68bc1182b48637370d80
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4L9Y6kq/zNOPIyzjbKgV3iJSfk6VTg0JEYfBDZ0x:8uUIpT4vAj2Pa9C3y3bdVSJGkKpJBpd2
- TLSH
  T104232A003BE9C12BF2BE4F78A9F26105867AB5633603D5491CC452DB5B13FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2