asyncrat | 2defed8fac4f9d66e7293c21ece5e6514a4991fa7d31a23bb710a465db35713a

Sharing

Copy URL Twitter E-mail

General

Target
2defed8fac4f9d66e7293c21ece5e6514a4991fa7d31a23bb710a465db35713a
Size 45KB
Sample260817-vmyhvsverf
SHA256 2defed8fac4f9d66e7293c21ece5e6514a4991fa7d31a23bb710a465db35713a
MD5 ca1d9a9e29b72310fe2b95ef0b06b72a
SHA1 4bcf24ae5a414a47b63d422b89126c6e98d20033
SHA512 e70f7b99126709d53fb1be5324d53c7e00af339fe0dc381905a332f354d4b9a295455c527f0ee9ee4d0293e38a02a86cee2055672389c482726d2f6bb53a24f8
SSDEEP 768:ju4dNJTbXcZz1WUBHCjmo2qrhpt0CCM+d4CvS8PIM+jb5gX3imIZE+8UQv/kBDZb:ju4dNJTjOK2O/CFWBMybWXSudUQHSddx
TLSH
T1B0232B003BE9812BF2BE4F7499F26145867AF6632A03D54D1C8441DB1623FC6DA43AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
blacklotus.e.streamforester.name:80
blacklotus.e.streamforester.name:22
blacklotus.e.streamforester.name:8080
blacklotus.e.streamforester.name:8880
blacklotus.e.streamforester.name:2052
blacklotus.e.streamforester.name:2082
blacklotus.e.streamforester.name:2086
blacklotus.e.streamforester.name:2095
blacklotus.e.streamforester.name:443
blacklotus.e.streamforester.name:2053
blacklotus.e.streamforester.name:2083
blacklotus.e.streamforester.name:2087
blacklotus.e.streamforester.name:2096
blacklotus.e.streamforester.name:8443
malware.e.streamforester.name:80
malware.e.streamforester.name:22
malware.e.streamforester.name:8080
malware.e.streamforester.name:8880
malware.e.streamforester.name:2052
malware.e.streamforester.name:2082
malware.e.streamforester.name:2086
malware.e.streamforester.name:2095
malware.e.streamforester.name:443
malware.e.streamforester.name:2053
malware.e.streamforester.name:2083
malware.e.streamforester.name:2087
malware.e.streamforester.name:2096
malware.e.streamforester.name:8443
ryuk.e.streamforester.name:80
ryuk.e.streamforester.name:22
ryuk.e.streamforester.name:8080
ryuk.e.streamforester.name:8880
ryuk.e.streamforester.name:2052
ryuk.e.streamforester.name:2082
ryuk.e.streamforester.name:2086
ryuk.e.streamforester.name:2095
ryuk.e.streamforester.name:443
ryuk.e.streamforester.name:2053
ryuk.e.streamforester.name:2083
ryuk.e.streamforester.name:2087
ryuk.e.streamforester.name:2096
ryuk.e.streamforester.name:8443
downadup.e.streamforester.name:80
downadup.e.streamforester.name:22
downadup.e.streamforester.name:8080
downadup.e.streamforester.name:8880
downadup.e.streamforester.name:2052
downadup.e.streamforester.name:2082
downadup.e.streamforester.name:2086
downadup.e.streamforester.name:2095
downadup.e.streamforester.name:443
downadup.e.streamforester.name:2053
downadup.e.streamforester.name:2083
downadup.e.streamforester.name:2087
downadup.e.streamforester.name:2096
downadup.e.streamforester.name:8443

Mutex

dOcmejiCJNjf

Attributes

delay
0
install
true
install_file
r03b.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2defed8fac4f9d66e7293c21ece5e6514a4991fa7d31a23bb710a465db35713a
- Size 45KB
- SHA256 2defed8fac4f9d66e7293c21ece5e6514a4991fa7d31a23bb710a465db35713a
- MD5 ca1d9a9e29b72310fe2b95ef0b06b72a
- SHA1 4bcf24ae5a414a47b63d422b89126c6e98d20033
- SHA512 e70f7b99126709d53fb1be5324d53c7e00af339fe0dc381905a332f354d4b9a295455c527f0ee9ee4d0293e38a02a86cee2055672389c482726d2f6bb53a24f8
- SSDEEP 768:ju4dNJTbXcZz1WUBHCjmo2qrhpt0CCM+d4CvS8PIM+jb5gX3imIZE+8UQv/kBDZb:ju4dNJTjOK2O/CFWBMybWXSudUQHSddx
- TLSH
  T1B0232B003BE9812BF2BE4F7499F26145867AF6632A03D54D1C8441DB1623FC6DA43AEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2