asyncrat | b2e0ee322df562e318adabb71470a39caf609d84dfbe29859ce709cb1dacddd1

Sharing

Copy URL Twitter E-mail

General

Target
b2e0ee322df562e318adabb71470a39caf609d84dfbe29859ce709cb1dacddd1
Size 45KB
Sample260821-ph3zwsbd63
SHA256 b2e0ee322df562e318adabb71470a39caf609d84dfbe29859ce709cb1dacddd1
MD5 faa5d094dad7fb2183d654a2463fb8af
SHA1 3d2638b7378e4be78c6ca6b7c29bb458ec6a4b6f
SHA512 8faf37c559af1001e578e09de51055dd3da61624b1d5fdb55b7f2beeff31c8183252ce7193be6e45cc70b053016ad56b5e51e8ac64e671f040e8fd0c87f91ace
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPImMjbfgX3iha9dUtYkTzt+8OBDZsx:EulCJTHl42sU3m8boXSs0Nedsx
TLSH
T12A231B0037E8C12BF2BE5F78ADF25145867AF2673603D54A2CC451DB4623BC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
zbot.e.streamforester.name:80
zbot.e.streamforester.name:22
zbot.e.streamforester.name:8080
zbot.e.streamforester.name:8880
zbot.e.streamforester.name:2052
zbot.e.streamforester.name:2082
zbot.e.streamforester.name:2086
zbot.e.streamforester.name:2095
zbot.e.streamforester.name:443
zbot.e.streamforester.name:2053
zbot.e.streamforester.name:2083
zbot.e.streamforester.name:2087
zbot.e.streamforester.name:2096
zbot.e.streamforester.name:8443
stuxnet.e.streamforester.name:80
stuxnet.e.streamforester.name:22
stuxnet.e.streamforester.name:8080
stuxnet.e.streamforester.name:8880
stuxnet.e.streamforester.name:2052
stuxnet.e.streamforester.name:2082
stuxnet.e.streamforester.name:2086
stuxnet.e.streamforester.name:2095
stuxnet.e.streamforester.name:443
stuxnet.e.streamforester.name:2053
stuxnet.e.streamforester.name:2083
stuxnet.e.streamforester.name:2087
stuxnet.e.streamforester.name:2096
stuxnet.e.streamforester.name:8443

Mutex

OGEtHJr7RDI6

Attributes

delay
0
install
true
install_file
xzi5hc.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b2e0ee322df562e318adabb71470a39caf609d84dfbe29859ce709cb1dacddd1
- Size 45KB
- SHA256 b2e0ee322df562e318adabb71470a39caf609d84dfbe29859ce709cb1dacddd1
- MD5 faa5d094dad7fb2183d654a2463fb8af
- SHA1 3d2638b7378e4be78c6ca6b7c29bb458ec6a4b6f
- SHA512 8faf37c559af1001e578e09de51055dd3da61624b1d5fdb55b7f2beeff31c8183252ce7193be6e45cc70b053016ad56b5e51e8ac64e671f040e8fd0c87f91ace
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPImMjbfgX3iha9dUtYkTzt+8OBDZsx:EulCJTHl42sU3m8boXSs0Nedsx
- TLSH
  T12A231B0037E8C12BF2BE5F78ADF25145867AF2673603D54A2CC451DB4623BC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2