asyncrat | 2b0816a528a98fe90c45e857dd8ba08762160efc98d01c873142124c3489148a

Sharing

Copy URL Twitter E-mail

General

Target
2b0816a528a98fe90c45e857dd8ba08762160efc98d01c873142124c3489148a
Size 45KB
Sample260821-qhpb6ser91
SHA256 2b0816a528a98fe90c45e857dd8ba08762160efc98d01c873142124c3489148a
MD5 c27c6067eb9603ecc4e997bbdc0c45fe
SHA1 e864832c822cf0ca2dbcf609bd0509087f789df8
SHA512 265726c00797e3ac81083c33f4fb98d98be14f275836dc4c7e724fb9eab45aeab193fdfb77f22ff018cbf9f62d0ab13a20b7608b02e9376239faf94388d83c8e
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIkNjbYgX3isioSgjhZrvCOBDZG:MuBGJTPho2Q/CFWBkFbPXSsK0ldEx
TLSH
T171231A0037E9812BF2BE4B789DF26245867AF5732603D5491CC451DB5B23FC68A43AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
cl0p.e.streamforester.name:80
cl0p.e.streamforester.name:22
cl0p.e.streamforester.name:8080
cl0p.e.streamforester.name:8880
cl0p.e.streamforester.name:2052
cl0p.e.streamforester.name:2082
cl0p.e.streamforester.name:2086
cl0p.e.streamforester.name:2095
cl0p.e.streamforester.name:443
cl0p.e.streamforester.name:2053
cl0p.e.streamforester.name:2083
cl0p.e.streamforester.name:2087
cl0p.e.streamforester.name:2096
cl0p.e.streamforester.name:8443
rat.e.streamforester.name:80
rat.e.streamforester.name:22
rat.e.streamforester.name:8080
rat.e.streamforester.name:8880
rat.e.streamforester.name:2052
rat.e.streamforester.name:2082
rat.e.streamforester.name:2086
rat.e.streamforester.name:2095
rat.e.streamforester.name:443
rat.e.streamforester.name:2053
rat.e.streamforester.name:2083
rat.e.streamforester.name:2087
rat.e.streamforester.name:2096
rat.e.streamforester.name:8443

Mutex

AWLGyUcwUtS9

Attributes

delay
0
install
true
install_file
g1ic.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2b0816a528a98fe90c45e857dd8ba08762160efc98d01c873142124c3489148a
- Size 45KB
- SHA256 2b0816a528a98fe90c45e857dd8ba08762160efc98d01c873142124c3489148a
- MD5 c27c6067eb9603ecc4e997bbdc0c45fe
- SHA1 e864832c822cf0ca2dbcf609bd0509087f789df8
- SHA512 265726c00797e3ac81083c33f4fb98d98be14f275836dc4c7e724fb9eab45aeab193fdfb77f22ff018cbf9f62d0ab13a20b7608b02e9376239faf94388d83c8e
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIkNjbYgX3isioSgjhZrvCOBDZG:MuBGJTPho2Q/CFWBkFbPXSsK0ldEx
- TLSH
  T171231A0037E9812BF2BE4B789DF26245867AF5732603D5491CC451DB5B23FC68A43AEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2