asyncrat | cc8d448672fc069fa20d1643c7295da6a440e52295057bf6fac9ccb045b05eb6

Sharing

Copy URL Twitter E-mail

General

Target
cc8d448672fc069fa20d1643c7295da6a440e52295057bf6fac9ccb045b05eb6
Size 45KB
Sample260821-mkhevssvez
SHA256 cc8d448672fc069fa20d1643c7295da6a440e52295057bf6fac9ccb045b05eb6
MD5 457ce5fdd0b2670ff2d3d580fee898ef
SHA1 cde8811ddc405c705a1154786957a0dc2912c78d
SHA512 6856945f6eccde4427094f5d755697266c4f6b60490303920f924b85fb3a38356eaa1a333a3eb6d8a94e70e779326adb4116b838ca2a30f283692f502516bcec
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA3BzCQKx7PImNjbagX3iT+tA1prrMhL6kBDZcx:UuKWgSJTwRf2no0mFbNXSaqXUdcx
TLSH
T16C231B003BE8822BF2BE5FB49CF25145857AE5633603D9492CC451DB5A23FC6DA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

streamforester.name:80
streamforester.name:22
streamforester.name:8080
streamforester.name:8880
streamforester.name:2052
streamforester.name:2082
streamforester.name:2086
streamforester.name:2095
streamforester.name:443
streamforester.name:2053
streamforester.name:2083
streamforester.name:2087
streamforester.name:2096
streamforester.name:8443
www.streamforester.name:80
www.streamforester.name:22
www.streamforester.name:8080
www.streamforester.name:8880
www.streamforester.name:2052
www.streamforester.name:2082
www.streamforester.name:2086
www.streamforester.name:2095
www.streamforester.name:443
www.streamforester.name:2053
www.streamforester.name:2083
www.streamforester.name:2087
www.streamforester.name:2096
www.streamforester.name:8443
lokibot.streamforester.name:80
lokibot.streamforester.name:22
lokibot.streamforester.name:8080
lokibot.streamforester.name:8880
lokibot.streamforester.name:2052
lokibot.streamforester.name:2082
lokibot.streamforester.name:2086
lokibot.streamforester.name:2095
lokibot.streamforester.name:443
lokibot.streamforester.name:2053
lokibot.streamforester.name:2083
lokibot.streamforester.name:2087
lokibot.streamforester.name:2096
lokibot.streamforester.name:8443
cl0p.streamforester.name:80
cl0p.streamforester.name:22
cl0p.streamforester.name:8080
cl0p.streamforester.name:8880
cl0p.streamforester.name:2052
cl0p.streamforester.name:2082
cl0p.streamforester.name:2086
cl0p.streamforester.name:2095
cl0p.streamforester.name:443
cl0p.streamforester.name:2053
cl0p.streamforester.name:2083
cl0p.streamforester.name:2087
cl0p.streamforester.name:2096
cl0p.streamforester.name:8443
stuxnet.streamforester.name:80
stuxnet.streamforester.name:22
stuxnet.streamforester.name:8080
stuxnet.streamforester.name:8880
stuxnet.streamforester.name:2052
stuxnet.streamforester.name:2082
stuxnet.streamforester.name:2086
stuxnet.streamforester.name:2095
stuxnet.streamforester.name:443
stuxnet.streamforester.name:2053
stuxnet.streamforester.name:2083
stuxnet.streamforester.name:2087
stuxnet.streamforester.name:2096
stuxnet.streamforester.name:8443

Mutex

rrGHNixDtjP0

Attributes

delay
0
install
true
install_file
pjjcde8d.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  cc8d448672fc069fa20d1643c7295da6a440e52295057bf6fac9ccb045b05eb6
- Size 45KB
- SHA256 cc8d448672fc069fa20d1643c7295da6a440e52295057bf6fac9ccb045b05eb6
- MD5 457ce5fdd0b2670ff2d3d580fee898ef
- SHA1 cde8811ddc405c705a1154786957a0dc2912c78d
- SHA512 6856945f6eccde4427094f5d755697266c4f6b60490303920f924b85fb3a38356eaa1a333a3eb6d8a94e70e779326adb4116b838ca2a30f283692f502516bcec
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA3BzCQKx7PImNjbagX3iT+tA1prrMhL6kBDZcx:UuKWgSJTwRf2no0mFbNXSaqXUdcx
- TLSH
  T16C231B003BE8822BF2BE5FB49CF25145857AE5633603D9492CC451DB5A23FC6DA426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2