asyncrat | 04c5f1ff7dc99ba868477433ad566cda59e0b58724caabed4159d16434a47958

Sharing

Copy URL Twitter E-mail

General

Target
04c5f1ff7dc99ba868477433ad566cda59e0b58724caabed4159d16434a47958
Size 45KB
Sample260821-p259cszhkc
SHA256 04c5f1ff7dc99ba868477433ad566cda59e0b58724caabed4159d16434a47958
MD5 7de24dd98de62e89d440c37972e5c92e
SHA1 1a4f769cc2a7010a053184a601628b9c3c6682f0
SHA512 5d3e0d799048fe42a06a01ca4e500e83df74df4c70764139ff6ef431e3045cc1c3dc34650631179b5d85733a25c7b27955c28a2f432dacef43a615e95fdf0874
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qA5pt0CCMhdjCvS8PIjcjbrgX3iIdijc3zmNPuu1B0:cuqNJTLr62J/CChBjsbUXSIdibGubdUx
TLSH
T155230A0037E9812BF2BE4F74A9F26245867AF6637603D9491CC441DB5B13BC68A436FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
blacklotus.e.streamforester.name:80
blacklotus.e.streamforester.name:22
blacklotus.e.streamforester.name:8080
blacklotus.e.streamforester.name:8880
blacklotus.e.streamforester.name:2052
blacklotus.e.streamforester.name:2082
blacklotus.e.streamforester.name:2086
blacklotus.e.streamforester.name:2095
blacklotus.e.streamforester.name:443
blacklotus.e.streamforester.name:2053
blacklotus.e.streamforester.name:2083
blacklotus.e.streamforester.name:2087
blacklotus.e.streamforester.name:2096
blacklotus.e.streamforester.name:8443
stuxnet.e.streamforester.name:80
stuxnet.e.streamforester.name:22
stuxnet.e.streamforester.name:8080
stuxnet.e.streamforester.name:8880
stuxnet.e.streamforester.name:2052
stuxnet.e.streamforester.name:2082
stuxnet.e.streamforester.name:2086
stuxnet.e.streamforester.name:2095
stuxnet.e.streamforester.name:443
stuxnet.e.streamforester.name:2053
stuxnet.e.streamforester.name:2083
stuxnet.e.streamforester.name:2087
stuxnet.e.streamforester.name:2096
stuxnet.e.streamforester.name:8443
sodinokibi.e.streamforester.name:80
sodinokibi.e.streamforester.name:22
sodinokibi.e.streamforester.name:8080
sodinokibi.e.streamforester.name:8880
sodinokibi.e.streamforester.name:2052
sodinokibi.e.streamforester.name:2082
sodinokibi.e.streamforester.name:2086
sodinokibi.e.streamforester.name:2095
sodinokibi.e.streamforester.name:443
sodinokibi.e.streamforester.name:2053
sodinokibi.e.streamforester.name:2083
sodinokibi.e.streamforester.name:2087
sodinokibi.e.streamforester.name:2096
sodinokibi.e.streamforester.name:8443

Mutex

9STxhB7gNxu4

Attributes

delay
0
install
true
install_file
egra.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  04c5f1ff7dc99ba868477433ad566cda59e0b58724caabed4159d16434a47958
- Size 45KB
- SHA256 04c5f1ff7dc99ba868477433ad566cda59e0b58724caabed4159d16434a47958
- MD5 7de24dd98de62e89d440c37972e5c92e
- SHA1 1a4f769cc2a7010a053184a601628b9c3c6682f0
- SHA512 5d3e0d799048fe42a06a01ca4e500e83df74df4c70764139ff6ef431e3045cc1c3dc34650631179b5d85733a25c7b27955c28a2f432dacef43a615e95fdf0874
- SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qA5pt0CCMhdjCvS8PIjcjbrgX3iIdijc3zmNPuu1B0:cuqNJTLr62J/CChBjsbUXSIdibGubdUx
- TLSH
  T155230A0037E9812BF2BE4F74A9F26245867AF6637603D9491CC441DB5B13BC68A436FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2