asyncrat | 8b34a7966a18ce9d80593261d2432ca5de3813d5c193b03632781ae6a96fb2fb

Sharing

Copy URL Twitter E-mail

General

Target
8b34a7966a18ce9d80593261d2432ca5de3813d5c193b03632781ae6a96fb2fb
Size 45KB
Sample260821-rbjnsa1fpg
SHA256 8b34a7966a18ce9d80593261d2432ca5de3813d5c193b03632781ae6a96fb2fb
MD5 c47df85bd25402b639f271a4c4c17c11
SHA1 564d84c8b3a96790af17f131e6b6bad058919b75
SHA512 b1719baaaeae06f8015fa5378d3e5ce11a1082465019cc34b4b85990e6ed6529835488e602cbce92028b819ed989bc9ce3956ecf4d35783d567fb17e119eb99f
SSDEEP 768:ju4dNJTbXcZz1WUBHCjmo2qraLiE0XFjrdjYkk8PIipjbmgX3i/HNevxElo/Z/mf:ju4dNJTjOK29L4XQBiJb5XS1eate+egR
TLSH
T12C232B003BE9812BF2BE4F7469F26145867AF5732A03D64E1C8451DB5723BC68643AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
gootloader.e.streamforester.name:80
gootloader.e.streamforester.name:22
gootloader.e.streamforester.name:8080
gootloader.e.streamforester.name:8880
gootloader.e.streamforester.name:2052
gootloader.e.streamforester.name:2082
gootloader.e.streamforester.name:2086
gootloader.e.streamforester.name:2095
gootloader.e.streamforester.name:443
gootloader.e.streamforester.name:2053
gootloader.e.streamforester.name:2083
gootloader.e.streamforester.name:2087
gootloader.e.streamforester.name:2096
gootloader.e.streamforester.name:8443
mydoom.e.streamforester.name:80
mydoom.e.streamforester.name:22
mydoom.e.streamforester.name:8080
mydoom.e.streamforester.name:8880
mydoom.e.streamforester.name:2052
mydoom.e.streamforester.name:2082
mydoom.e.streamforester.name:2086
mydoom.e.streamforester.name:2095
mydoom.e.streamforester.name:443
mydoom.e.streamforester.name:2053
mydoom.e.streamforester.name:2083
mydoom.e.streamforester.name:2087
mydoom.e.streamforester.name:2096
mydoom.e.streamforester.name:8443
hack.e.streamforester.name:80
hack.e.streamforester.name:22
hack.e.streamforester.name:8080
hack.e.streamforester.name:8880
hack.e.streamforester.name:2052
hack.e.streamforester.name:2082
hack.e.streamforester.name:2086
hack.e.streamforester.name:2095
hack.e.streamforester.name:443
hack.e.streamforester.name:2053
hack.e.streamforester.name:2083
hack.e.streamforester.name:2087
hack.e.streamforester.name:2096
hack.e.streamforester.name:8443
malware.e.streamforester.name:80
malware.e.streamforester.name:22
malware.e.streamforester.name:8080
malware.e.streamforester.name:8880
malware.e.streamforester.name:2052
malware.e.streamforester.name:2082
malware.e.streamforester.name:2086
malware.e.streamforester.name:2095
malware.e.streamforester.name:443
malware.e.streamforester.name:2053
malware.e.streamforester.name:2083
malware.e.streamforester.name:2087
malware.e.streamforester.name:2096
malware.e.streamforester.name:8443

Mutex

iwHozzC9ZOR3

Attributes

delay
0
install
true
install_file
6u96.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  8b34a7966a18ce9d80593261d2432ca5de3813d5c193b03632781ae6a96fb2fb
- Size 45KB
- SHA256 8b34a7966a18ce9d80593261d2432ca5de3813d5c193b03632781ae6a96fb2fb
- MD5 c47df85bd25402b639f271a4c4c17c11
- SHA1 564d84c8b3a96790af17f131e6b6bad058919b75
- SHA512 b1719baaaeae06f8015fa5378d3e5ce11a1082465019cc34b4b85990e6ed6529835488e602cbce92028b819ed989bc9ce3956ecf4d35783d567fb17e119eb99f
- SSDEEP 768:ju4dNJTbXcZz1WUBHCjmo2qraLiE0XFjrdjYkk8PIipjbmgX3i/HNevxElo/Z/mf:ju4dNJTjOK29L4XQBiJb5XS1eate+egR
- TLSH
  T12C232B003BE9812BF2BE4F7469F26145867AF5732A03D64E1C8451DB5723BC68643AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2