asyncrat | 2ad6b862a6edf066891d1ad291235e1dc2e2d3f384966c39b0232e5f79012908

Sharing

Copy URL Twitter E-mail

General

Target
2ad6b862a6edf066891d1ad291235e1dc2e2d3f384966c39b0232e5f79012908
Size 45KB
Sample260821-pgzwvaek5s
SHA256 2ad6b862a6edf066891d1ad291235e1dc2e2d3f384966c39b0232e5f79012908
MD5 7f3bea1c96fcc4e07f100df275a0b1cb
SHA1 e70ff78a4ff4f7c3ea62fc88e9039b1b30204931
SHA512 12efd370dd7f2540367cca32e6628afc67f079a0ad599eb498b2d0fc5d0a66a2826fc0142b6cc0fd710841d91a9135bd0f49e6d932b6919a51176482799945cc
SSDEEP 768:ju4dNJTbXcZz1WUBHCjmo2qraLiE0yFjrdjYkk8PIuejblgX3iV3fhDbXBhPObJD:ju4dNJTjOK29LBXQBuSbiXSlpBh0AOhR
TLSH
T1B6231B0037EDC12BF2BE4F7859F26245867AE6736603D54A1C8441DB5723FC29A43AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
hermeticwiper.e.streamforester.name:80
hermeticwiper.e.streamforester.name:22
hermeticwiper.e.streamforester.name:8080
hermeticwiper.e.streamforester.name:8880
hermeticwiper.e.streamforester.name:2052
hermeticwiper.e.streamforester.name:2082
hermeticwiper.e.streamforester.name:2086
hermeticwiper.e.streamforester.name:2095
hermeticwiper.e.streamforester.name:443
hermeticwiper.e.streamforester.name:2053
hermeticwiper.e.streamforester.name:2083
hermeticwiper.e.streamforester.name:2087
hermeticwiper.e.streamforester.name:2096
hermeticwiper.e.streamforester.name:8443
formbook.e.streamforester.name:80
formbook.e.streamforester.name:22
formbook.e.streamforester.name:8080
formbook.e.streamforester.name:8880
formbook.e.streamforester.name:2052
formbook.e.streamforester.name:2082
formbook.e.streamforester.name:2086
formbook.e.streamforester.name:2095
formbook.e.streamforester.name:443
formbook.e.streamforester.name:2053
formbook.e.streamforester.name:2083
formbook.e.streamforester.name:2087
formbook.e.streamforester.name:2096
formbook.e.streamforester.name:8443
stuxnet.e.streamforester.name:80
stuxnet.e.streamforester.name:22
stuxnet.e.streamforester.name:8080
stuxnet.e.streamforester.name:8880
stuxnet.e.streamforester.name:2052
stuxnet.e.streamforester.name:2082
stuxnet.e.streamforester.name:2086
stuxnet.e.streamforester.name:2095
stuxnet.e.streamforester.name:443
stuxnet.e.streamforester.name:2053
stuxnet.e.streamforester.name:2083
stuxnet.e.streamforester.name:2087
stuxnet.e.streamforester.name:2096
stuxnet.e.streamforester.name:8443
ryuk.e.streamforester.name:80
ryuk.e.streamforester.name:22
ryuk.e.streamforester.name:8080
ryuk.e.streamforester.name:8880
ryuk.e.streamforester.name:2052
ryuk.e.streamforester.name:2082
ryuk.e.streamforester.name:2086
ryuk.e.streamforester.name:2095
ryuk.e.streamforester.name:443
ryuk.e.streamforester.name:2053
ryuk.e.streamforester.name:2083
ryuk.e.streamforester.name:2087
ryuk.e.streamforester.name:2096
ryuk.e.streamforester.name:8443

Mutex

Xaou5SHYpE9Y

Attributes

delay
0
install
true
install_file
um87.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2ad6b862a6edf066891d1ad291235e1dc2e2d3f384966c39b0232e5f79012908
- Size 45KB
- SHA256 2ad6b862a6edf066891d1ad291235e1dc2e2d3f384966c39b0232e5f79012908
- MD5 7f3bea1c96fcc4e07f100df275a0b1cb
- SHA1 e70ff78a4ff4f7c3ea62fc88e9039b1b30204931
- SHA512 12efd370dd7f2540367cca32e6628afc67f079a0ad599eb498b2d0fc5d0a66a2826fc0142b6cc0fd710841d91a9135bd0f49e6d932b6919a51176482799945cc
- SSDEEP 768:ju4dNJTbXcZz1WUBHCjmo2qraLiE0yFjrdjYkk8PIuejblgX3iV3fhDbXBhPObJD:ju4dNJTjOK29LBXQBuSbiXSlpBh0AOhR
- TLSH
  T1B6231B0037EDC12BF2BE4F7859F26245867AE6736603D54A1C8441DB5723FC29A43AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2