asyncrat | f84045947d1b0021059b74dec72cf517ce0753b3dbe1910ecb84ece5959e780f

Sharing

Copy URL Twitter E-mail

General

Target
f84045947d1b0021059b74dec72cf517ce0753b3dbe1910ecb84ece5959e780f
Size 45KB
Sample260907-yekhtavbjb
SHA256 f84045947d1b0021059b74dec72cf517ce0753b3dbe1910ecb84ece5959e780f
MD5 f2031590107e86cf0e00e06d346eaab4
SHA1 18616928b6fde13e8904c2ad0822252b34b62775
SHA512 8f71bde728b9ad73252e9e9cd553104e3034776b41991e47b43890baf2eb337758dba57657498f367b6746309225e9655c1abbd0f53c97b7a6cf2b7e1a5106ef
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q12FpPklON8APIDzjbbgX3iPikDWbjD5xIlEBDZUx:cu6YepTPso2f7kwN8lD3bkXSCbPvZdUx
TLSH
T1A623180037EC813BF2BE4B7899F26145867AF5637603D68A1CC452DB5723FC68A426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chimchuot.click:80
chimchuot.click:22
chimchuot.click:8080
chimchuot.click:8880
chimchuot.click:2052
chimchuot.click:2082
chimchuot.click:2086
chimchuot.click:2095
chimchuot.click:443
chimchuot.click:2053
chimchuot.click:2083
chimchuot.click:2087
chimchuot.click:2096
chimchuot.click:8443
www.chimchuot.click:80
www.chimchuot.click:22
www.chimchuot.click:8080
www.chimchuot.click:8880
www.chimchuot.click:2052
www.chimchuot.click:2082
www.chimchuot.click:2086
www.chimchuot.click:2095
www.chimchuot.click:443
www.chimchuot.click:2053
www.chimchuot.click:2083
www.chimchuot.click:2087
www.chimchuot.click:2096
www.chimchuot.click:8443
wannacry.chimchuot.click:80
wannacry.chimchuot.click:22
wannacry.chimchuot.click:8080
wannacry.chimchuot.click:8880
wannacry.chimchuot.click:2052
wannacry.chimchuot.click:2082
wannacry.chimchuot.click:2086
wannacry.chimchuot.click:2095
wannacry.chimchuot.click:443
wannacry.chimchuot.click:2053
wannacry.chimchuot.click:2083
wannacry.chimchuot.click:2087
wannacry.chimchuot.click:2096
wannacry.chimchuot.click:8443
gootloader.chimchuot.click:80
gootloader.chimchuot.click:22
gootloader.chimchuot.click:8080
gootloader.chimchuot.click:8880
gootloader.chimchuot.click:2052
gootloader.chimchuot.click:2082
gootloader.chimchuot.click:2086
gootloader.chimchuot.click:2095
gootloader.chimchuot.click:443
gootloader.chimchuot.click:2053
gootloader.chimchuot.click:2083
gootloader.chimchuot.click:2087
gootloader.chimchuot.click:2096
gootloader.chimchuot.click:8443
client.chimchuot.click:80
client.chimchuot.click:22
client.chimchuot.click:8080
client.chimchuot.click:8880
client.chimchuot.click:2052
client.chimchuot.click:2082
client.chimchuot.click:2086
client.chimchuot.click:2095
client.chimchuot.click:443
client.chimchuot.click:2053
client.chimchuot.click:2083
client.chimchuot.click:2087
client.chimchuot.click:2096
client.chimchuot.click:8443

Mutex

IXf28BJaSXGx

Attributes

delay
0
install
true
install_file
mq1hgjxy.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  f84045947d1b0021059b74dec72cf517ce0753b3dbe1910ecb84ece5959e780f
- Size 45KB
- SHA256 f84045947d1b0021059b74dec72cf517ce0753b3dbe1910ecb84ece5959e780f
- MD5 f2031590107e86cf0e00e06d346eaab4
- SHA1 18616928b6fde13e8904c2ad0822252b34b62775
- SHA512 8f71bde728b9ad73252e9e9cd553104e3034776b41991e47b43890baf2eb337758dba57657498f367b6746309225e9655c1abbd0f53c97b7a6cf2b7e1a5106ef
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q12FpPklON8APIDzjbbgX3iPikDWbjD5xIlEBDZUx:cu6YepTPso2f7kwN8lD3bkXSCbPvZdUx
- TLSH
  T1A623180037EC813BF2BE4B7899F26145867AF5637603D68A1CC452DB5723FC68A426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2