asyncrat | 3d9f6c18489f142deb8885c742ace12b[.]exe

General

Target
3d9f6c18489f142deb8885c742ace12b.exe
Size 49KB
Sample220727-njt8psdcem
SHA256 1636595f5dd5eee39bb56d389f9839bb802029c77a8bebf2ab9893b51e8fb4f5
MD5 3d9f6c18489f142deb8885c742ace12b
SHA1 0baded57c52d2b64f12e667e18c04d02487dbe42
SHA512 7907ba7e99f90699f1fd1e010c9860a7c57c461a46bcf92dd021858ce80869084837327b15d83c74fb33fdd0b86208dcc5bcd3b5826253ccbfe600227e8d28cd
SSDEEP 1536:f5kqOmrxf0IAVp9PQVb9fPJv2B7cRiLx:f5jOmrxf0IAp94Vb9R2BIqx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

C2

leetman.dyndns.info:1999

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

File Explorer

3d9f6c18489f142deb8885c742ace12b.exe

.exe 49KB

3d9f6c18489f142deb8885c742ace12b.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1636595f5dd5eee39bb56d389f9839bb802029c77a8bebf2ab9893b51e8fb4f5
MD5 3d9f6c18489f142deb8885c742ace12b
SHA1 0baded57c52d2b64f12e667e18c04d02487dbe42
SHA512 7907ba7e99f90699f1fd1e010c9860a7c57c461a46bcf92dd021858ce80869084837327b15d83c74fb33fdd0b86208dcc5bcd3b5826253ccbfe600227e8d28cd
SSDEEP 1536:f5kqOmrxf0IAVp9PQVb9fPJv2B7cRiLx:f5jOmrxf0IAp94Vb9R2BIqx
MD5 SHA1 SHA512 SSDEEP

windows x86

Async RAT payload

rat

Minor OS version

Major OS version

Entry point

55262

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing