asyncrat | af792cb3b2cca4e397cce79ca43b9fa1

Sharing

Copy URL Twitter E-mail

General

Target

af792cb3b2cca4e397cce79ca43b9fa1
Size

716KB
MD5

af792cb3b2cca4e397cce79ca43b9fa1
SHA1

b9b9a3ecca0320bc6fc9125c7683d7666fd5dc26
SHA256

f8b4af021e2a53932d5d8405689e9c15269be3c8c5a7c78ebd1e59d8f0c4a94e
SHA512

0b147fb074fec7501dae85d0a378e0cae54ad546ecec83db2cdfada378a8cb6052046cabf94cff8fbf243e4daa106a4201cacfa81ef58de0210336d2a641093a
SSDEEP

6144:p3dgZJcb5/P+KqB75mX5Y+yubpXDLO9YB3MogyYk7s6+2MH+DoSfpPsnr3dgZJcf:/ge9AoSk3fUBge9AoSk3fU9uG9QV

Score

10^/10

rat asyncrat

Malware Config

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Files

af792cb3b2cca4e397cce79ca43b9fa1
.exe windows:5 windows x86 arch:x86

50503c953b5db5345fe6a2b4c5ed7366

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ed:a4:00:ef:ce:e2:8e:ac:48:38:a7:f4:7c:24:1c:2a
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

22/06/2021, 00:00

Not After

21/06/2024, 23:59

Subject

CN=MB Oyun Yazilim ve Pazarlama AS,O=MB Oyun Yazilim ve Pazarlama AS,L=Sariyer,C=TR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:00:b2:62:5a:e5:5d:6d:3f:02:7d:51:8d:5b:a4:d9:61:28:8b:9f
Signer

Actual PE Digest

61:00:b2:62:5a:e5:5d:6d:3f:02:7d:51:8d:5b:a4:d9:61:28:8b:9f

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

ioctlsocket

libcurl

curl_easy_reset
curl_maprintf
curl_easy_perform
curl_easy_strerror
curl_mvfprintf
curl_mprintf
curl_easy_cleanup
curl_global_cleanup
curl_global_init
curl_easy_init
curl_version_info
curl_version
curl_strequal
curl_easy_escape
curl_getdate
curl_mime_init
curl_mime_addpart
curl_mime_subparts
curl_easy_setopt
curl_mime_type
curl_mime_encoder
curl_mime_data
curl_mime_name
curl_mime_filedata
curl_mime_filename
curl_mime_data_cb
curl_mvaprintf
curl_mime_free
curl_easy_pause
curl_getenv
curl_free
curl_easy_getinfo
curl_strnequal
curl_msnprintf
curl_mfprintf
curl_slist_append
curl_slist_free_all
curl_mime_headers

kernel32

Sleep
GetModuleFileNameA
GetConsoleMode
SetConsoleMode
GetEnvironmentVariableA
ExpandEnvironmentStringsA
SetFileTime
CreateFileA
GetFileTime
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetLastError
CreateToolhelp32Snapshot
CloseHandle
Module32First
Module32Next
SearchPathA
MultiByteToWideChar
WriteConsoleW
SetEndOfFile
GetStdHandle
GetTickCount
GetConsoleScreenBufferInfo

msvcr90

_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_read
_setmode
_fileno
_isatty
_mkdir
_strdup
_getch
_close
memchr
_strtoi64
_errno
malloc
free
strrchr
_localtime64
_time64
fflush
fputc
fputs
fwrite
fopen
__iob_func
memmove
strchr
memcpy
_open
strerror
rename
fclose
memset
strtol
_lseeki64
_get_osfhandle
strtok
strpbrk
strncpy
strncmp
fprintf
ferror
getc
sscanf
fread
fseek
_fstat64
ftell
calloc
strcspn
strstr
printf
puts
_stat64
setlocale
realloc
fgets
strtod
isprint
strtoul
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

50503c953b5db5345fe6a2b4c5ed7366

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

ed:a4:00:ef:ce:e2:8e:ac:48:38:a7:f4:7c:24:1c:2aCertificate

Extended Key Usages

Key Usages

61:00:b2:62:5a:e5:5d:6d:3f:02:7d:51:8d:5b:a4:d9:61:28:8b:9fSigner

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

libcurl

kernel32

msvcr90

Sections

.text Size: 71KB - Virtual size: 71KB

.rdata Size: 243KB - Virtual size: 243KB

.data Size: 512B - Virtual size: 984B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

ed:a4:00:ef:ce:e2:8e:ac:48:38:a7:f4:7c:24:1c:2a
Certificate

61:00:b2:62:5a:e5:5d:6d:3f:02:7d:51:8d:5b:a4:d9:61:28:8b:9f
Signer

.text
Size: 71KB - Virtual size: 71KB

.rdata
Size: 243KB - Virtual size: 243KB

.data
Size: 512B - Virtual size: 984B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB