asyncrat | 3574109c76d160a8790ac5de72944b4afa29902e5f1283049c329873a0eae0e2

Sharing

Copy URL Twitter E-mail

General

Target
3574109c76d160a8790ac5de72944b4afa29902e5f1283049c329873a0eae0e2
Size 45KB
Sample260817-wmabpscg76
SHA256 3574109c76d160a8790ac5de72944b4afa29902e5f1283049c329873a0eae0e2
MD5 39c77b5b1bafcc8a3ff4407ed80829a4
SHA1 469b0a39fe3a01fbdf143dcae9ac93d8355a6b15
SHA512 0e78022f3d01613f006754c69301ce36b136809837f15acea9cdb897e9205f654d4cd9bb1af5900192f8b7a13bb27cfe868f59f1a92569e4ecfcaef2f8d3b846
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1exGQG9PHuPIczjbIgv3iK1A2qde23zf0MKCrBDg:cu6YepTPso27HC3c3bfvSK1ALde2Df3S
TLSH
T18B232B003BE8812BF2BE5FB898F26146467AF6633603D54D2CC451DB5623FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
invasive.e.streamforester.name:80
invasive.e.streamforester.name:22
invasive.e.streamforester.name:8080
invasive.e.streamforester.name:8880
invasive.e.streamforester.name:2052
invasive.e.streamforester.name:2082
invasive.e.streamforester.name:2086
invasive.e.streamforester.name:2095
invasive.e.streamforester.name:443
invasive.e.streamforester.name:2053
invasive.e.streamforester.name:2083
invasive.e.streamforester.name:2087
invasive.e.streamforester.name:2096
invasive.e.streamforester.name:8443
shamoon.e.streamforester.name:80
shamoon.e.streamforester.name:22
shamoon.e.streamforester.name:8080
shamoon.e.streamforester.name:8880
shamoon.e.streamforester.name:2052
shamoon.e.streamforester.name:2082
shamoon.e.streamforester.name:2086
shamoon.e.streamforester.name:2095
shamoon.e.streamforester.name:443
shamoon.e.streamforester.name:2053
shamoon.e.streamforester.name:2083
shamoon.e.streamforester.name:2087
shamoon.e.streamforester.name:2096
shamoon.e.streamforester.name:8443

Mutex

pSrcA499xgbP

Attributes

delay
0
install
true
install_file
wh9owjzl.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  3574109c76d160a8790ac5de72944b4afa29902e5f1283049c329873a0eae0e2
- Size 45KB
- SHA256 3574109c76d160a8790ac5de72944b4afa29902e5f1283049c329873a0eae0e2
- MD5 39c77b5b1bafcc8a3ff4407ed80829a4
- SHA1 469b0a39fe3a01fbdf143dcae9ac93d8355a6b15
- SHA512 0e78022f3d01613f006754c69301ce36b136809837f15acea9cdb897e9205f654d4cd9bb1af5900192f8b7a13bb27cfe868f59f1a92569e4ecfcaef2f8d3b846
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1exGQG9PHuPIczjbIgv3iK1A2qde23zf0MKCrBDg:cu6YepTPso27HC3c3bfvSK1ALde2Df3S
- TLSH
  T18B232B003BE8812BF2BE5FB898F26146467AF6633603D54D2CC451DB5623FC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2