asyncrat | 1a7ca2bfa11995103c0f4d89e1da02cdac464741df1c40448e0827d48ba9fcce

Sharing

Copy URL Twitter E-mail

General

Target
1a7ca2bfa11995103c0f4d89e1da02cdac464741df1c40448e0827d48ba9fcce
Size 45KB
Sample260821-tvfscatcmc
SHA256 1a7ca2bfa11995103c0f4d89e1da02cdac464741df1c40448e0827d48ba9fcce
MD5 7ee5191d2df9cac748bdc99df1305732
SHA1 27ee8b98b46588b324248de656247165ab4a4b9c
SHA512 e94a584a17314c2fbc9926fea4654d37bea2c29189839e305bca4011336a591ae55051c81ee75e474d8a896943147f00bbb405893504811a4cde78793ee1baf3
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1T6W+VgO8tPIYzjbggX3ifBoouFZJ3J/BDZUx:cu6YepTPso2msFY3bHXSmZ5dUx
TLSH
T1A0231A003BE8813BF2BE4FB8A8F26145867AF1637603D64D6CC451DB5623FC696426E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

streamforester.name:80
streamforester.name:22
streamforester.name:8080
streamforester.name:8880
streamforester.name:2052
streamforester.name:2082
streamforester.name:2086
streamforester.name:2095
streamforester.name:443
streamforester.name:2053
streamforester.name:2083
streamforester.name:2087
streamforester.name:2096
streamforester.name:8443
www.streamforester.name:80
www.streamforester.name:22
www.streamforester.name:8080
www.streamforester.name:8880
www.streamforester.name:2052
www.streamforester.name:2082
www.streamforester.name:2086
www.streamforester.name:2095
www.streamforester.name:443
www.streamforester.name:2053
www.streamforester.name:2083
www.streamforester.name:2087
www.streamforester.name:2096
www.streamforester.name:8443
conficker.streamforester.name:80
conficker.streamforester.name:22
conficker.streamforester.name:8080
conficker.streamforester.name:8880
conficker.streamforester.name:2052
conficker.streamforester.name:2082
conficker.streamforester.name:2086
conficker.streamforester.name:2095
conficker.streamforester.name:443
conficker.streamforester.name:2053
conficker.streamforester.name:2083
conficker.streamforester.name:2087
conficker.streamforester.name:2096
conficker.streamforester.name:8443
zeus.streamforester.name:80
zeus.streamforester.name:22
zeus.streamforester.name:8080
zeus.streamforester.name:8880
zeus.streamforester.name:2052
zeus.streamforester.name:2082
zeus.streamforester.name:2086
zeus.streamforester.name:2095
zeus.streamforester.name:443
zeus.streamforester.name:2053
zeus.streamforester.name:2083
zeus.streamforester.name:2087
zeus.streamforester.name:2096
zeus.streamforester.name:8443

Mutex

tVQtTgMbi5fZ

Attributes

delay
0
install
true
install_file
5aal8nse.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1a7ca2bfa11995103c0f4d89e1da02cdac464741df1c40448e0827d48ba9fcce
- Size 45KB
- SHA256 1a7ca2bfa11995103c0f4d89e1da02cdac464741df1c40448e0827d48ba9fcce
- MD5 7ee5191d2df9cac748bdc99df1305732
- SHA1 27ee8b98b46588b324248de656247165ab4a4b9c
- SHA512 e94a584a17314c2fbc9926fea4654d37bea2c29189839e305bca4011336a591ae55051c81ee75e474d8a896943147f00bbb405893504811a4cde78793ee1baf3
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1T6W+VgO8tPIYzjbggX3ifBoouFZJ3J/BDZUx:cu6YepTPso2msFY3bHXSmZ5dUx
- TLSH
  T1A0231A003BE8813BF2BE4FB8A8F26145867AF1637603D64D6CC451DB5623FC696426E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2