asyncrat | 1afd881c1c305fd173b3d12229884e5c5666b83402915e96bb54df7326512b67

Sharing

Copy URL Twitter E-mail

General

Target
1afd881c1c305fd173b3d12229884e5c5666b83402915e96bb54df7326512b67
Size 45KB
Sample260821-ngfbrss1c1
SHA256 1afd881c1c305fd173b3d12229884e5c5666b83402915e96bb54df7326512b67
MD5 c80de677c12a05f4d5f290e7f016141c
SHA1 fe9caa0b54b3dbafc14a1fe6cb5ffa664efe2380
SHA512 e3ba136637f9adc74d2896fb6d16286f7aad82bb7018d33f8e9fcd8642f7703a7a9f3fd6ce52face775ef83ba5e5719f57883bc1b881dd3c7a9d5f96f7a6601d
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7et+xFNbwOPIMMzjb8gX3+X7skyIFChaBDZ8x:0ushJTDXgH2DIXc3MM3bTXOX73t8Ed8x
TLSH
T165231C0037D9C22BF2BE4F78A8F25145867AF6633603D64A1CC4529B5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

streamforester.name:80
streamforester.name:22
streamforester.name:8080
streamforester.name:8880
streamforester.name:2052
streamforester.name:2082
streamforester.name:2086
streamforester.name:2095
streamforester.name:443
streamforester.name:2053
streamforester.name:2083
streamforester.name:2087
streamforester.name:2096
streamforester.name:8443
www.streamforester.name:80
www.streamforester.name:22
www.streamforester.name:8080
www.streamforester.name:8880
www.streamforester.name:2052
www.streamforester.name:2082
www.streamforester.name:2086
www.streamforester.name:2095
www.streamforester.name:443
www.streamforester.name:2053
www.streamforester.name:2083
www.streamforester.name:2087
www.streamforester.name:2096
www.streamforester.name:8443
remcos.streamforester.name:80
remcos.streamforester.name:22
remcos.streamforester.name:8080
remcos.streamforester.name:8880
remcos.streamforester.name:2052
remcos.streamforester.name:2082
remcos.streamforester.name:2086
remcos.streamforester.name:2095
remcos.streamforester.name:443
remcos.streamforester.name:2053
remcos.streamforester.name:2083
remcos.streamforester.name:2087
remcos.streamforester.name:2096
remcos.streamforester.name:8443
cryptolocker.streamforester.name:80
cryptolocker.streamforester.name:22
cryptolocker.streamforester.name:8080
cryptolocker.streamforester.name:8880
cryptolocker.streamforester.name:2052
cryptolocker.streamforester.name:2082
cryptolocker.streamforester.name:2086
cryptolocker.streamforester.name:2095
cryptolocker.streamforester.name:443
cryptolocker.streamforester.name:2053
cryptolocker.streamforester.name:2083
cryptolocker.streamforester.name:2087
cryptolocker.streamforester.name:2096
cryptolocker.streamforester.name:8443
malware.streamforester.name:80
malware.streamforester.name:22
malware.streamforester.name:8080
malware.streamforester.name:8880
malware.streamforester.name:2052
malware.streamforester.name:2082
malware.streamforester.name:2086
malware.streamforester.name:2095
malware.streamforester.name:443
malware.streamforester.name:2053
malware.streamforester.name:2083
malware.streamforester.name:2087
malware.streamforester.name:2096
malware.streamforester.name:8443

Mutex

wlN28Crds4vN

Attributes

delay
0
install
true
install_file
9z1fms.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1afd881c1c305fd173b3d12229884e5c5666b83402915e96bb54df7326512b67
- Size 45KB
- SHA256 1afd881c1c305fd173b3d12229884e5c5666b83402915e96bb54df7326512b67
- MD5 c80de677c12a05f4d5f290e7f016141c
- SHA1 fe9caa0b54b3dbafc14a1fe6cb5ffa664efe2380
- SHA512 e3ba136637f9adc74d2896fb6d16286f7aad82bb7018d33f8e9fcd8642f7703a7a9f3fd6ce52face775ef83ba5e5719f57883bc1b881dd3c7a9d5f96f7a6601d
- SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7et+xFNbwOPIMMzjb8gX3+X7skyIFChaBDZ8x:0ushJTDXgH2DIXc3MM3bTXOX73t8Ed8x
- TLSH
  T165231C0037D9C22BF2BE4F78A8F25145867AF6633603D64A1CC4529B5613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2