asyncrat | 81360467b767c2eeada59a6b3946dd5baad78d947b5fc2e7b1695270939c23e2

Sharing

Copy URL Twitter E-mail

General

Target
81360467b767c2eeada59a6b3946dd5baad78d947b5fc2e7b1695270939c23e2
Size 43KB
Sample260228-x2kawsdv9d
SHA256 81360467b767c2eeada59a6b3946dd5baad78d947b5fc2e7b1695270939c23e2
MD5 c50826675515400a8ec4326e2131c2f2
SHA1 f587f3fd0b4a9d7998365b0b7d1cb0e75ba79fad
SHA512 3c43afcc67ff0804436e86df6361241ac6a2d3462806d427c18cf4f720a484872656f101df24194da69045428d8a40b7e05341faca5a1fd6e7598fac7d710171
SSDEEP 768:ktAXSQ398xI0zvlvf/XN6MuWbHDrgidQ8ekAZ7l+:kY8VrlXfN3uMHDrg78elJl+
TLSH
T1BF133C04BBE9C17BF3BE4F7854F2630545B5E9A72503EB4D1CC005EA0A17FC98A526EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

silent-frog-4440.hrmcxaeel.workers.dev:443
silent-frog-4440.hrmcxaeel.workers.dev:80
silent-frog-4440.hrmcxaeel.workers.dev:25
silent-frog-4440.hrmcxaeel.workers.dev:8443
www.silent-frog-4440.hrmcxaeel.workers.dev:443
www.silent-frog-4440.hrmcxaeel.workers.dev:80
www.silent-frog-4440.hrmcxaeel.workers.dev:25
www.silent-frog-4440.hrmcxaeel.workers.dev:8443
data.silent-frog-4440.hrmcxaeel.workers.dev:443
data.silent-frog-4440.hrmcxaeel.workers.dev:80
data.silent-frog-4440.hrmcxaeel.workers.dev:25
data.silent-frog-4440.hrmcxaeel.workers.dev:8443
malware.silent-frog-4440.hrmcxaeel.workers.dev:443
malware.silent-frog-4440.hrmcxaeel.workers.dev:80
malware.silent-frog-4440.hrmcxaeel.workers.dev:25
malware.silent-frog-4440.hrmcxaeel.workers.dev:8443
ddos.silent-frog-4440.hrmcxaeel.workers.dev:443
ddos.silent-frog-4440.hrmcxaeel.workers.dev:80
ddos.silent-frog-4440.hrmcxaeel.workers.dev:25
ddos.silent-frog-4440.hrmcxaeel.workers.dev:8443
v2.silent-frog-4440.hrmcxaeel.workers.dev:443
v2.silent-frog-4440.hrmcxaeel.workers.dev:80
v2.silent-frog-4440.hrmcxaeel.workers.dev:25
v2.silent-frog-4440.hrmcxaeel.workers.dev:8443
v3.silent-frog-4440.hrmcxaeel.workers.dev:443
v3.silent-frog-4440.hrmcxaeel.workers.dev:80
v3.silent-frog-4440.hrmcxaeel.workers.dev:25
v3.silent-frog-4440.hrmcxaeel.workers.dev:8443
atex.silent-frog-4440.hrmcxaeel.workers.dev:443
atex.silent-frog-4440.hrmcxaeel.workers.dev:80
atex.silent-frog-4440.hrmcxaeel.workers.dev:25
atex.silent-frog-4440.hrmcxaeel.workers.dev:8443
phishing.silent-frog-4440.hrmcxaeel.workers.dev:443
phishing.silent-frog-4440.hrmcxaeel.workers.dev:80
phishing.silent-frog-4440.hrmcxaeel.workers.dev:25
phishing.silent-frog-4440.hrmcxaeel.workers.dev:8443
backup.silent-frog-4440.hrmcxaeel.workers.dev:443
backup.silent-frog-4440.hrmcxaeel.workers.dev:80
backup.silent-frog-4440.hrmcxaeel.workers.dev:25
backup.silent-frog-4440.hrmcxaeel.workers.dev:8443
quantri.silent-frog-4440.hrmcxaeel.workers.dev:443
quantri.silent-frog-4440.hrmcxaeel.workers.dev:80
quantri.silent-frog-4440.hrmcxaeel.workers.dev:25
quantri.silent-frog-4440.hrmcxaeel.workers.dev:8443

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
9
install
true
install_file
gv2.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81360467b767c2eeada59a6b3946dd5baad78d947b5fc2e7b1695270939c23e2

File Explorer

81360467b767c2eeada59a6b3946dd5baad78d947b5fc2e7b1695270939c23e2

.exe 43KB

81360467b767c2eeada59a6b3946dd5baad78d947b5fc2e7b1695270939c23e2

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 81360467b767c2eeada59a6b3946dd5baad78d947b5fc2e7b1695270939c23e2
MD5 c50826675515400a8ec4326e2131c2f2
SHA1 f587f3fd0b4a9d7998365b0b7d1cb0e75ba79fad
SHA512 3c43afcc67ff0804436e86df6361241ac6a2d3462806d427c18cf4f720a484872656f101df24194da69045428d8a40b7e05341faca5a1fd6e7598fac7d710171
SSDEEP 768:ktAXSQ398xI0zvlvf/XN6MuWbHDrgidQ8ekAZ7l+:kY8VrlXfN3uMHDrg78elJl+
TLSH
T1BF133C04BBE9C17BF3BE4F7854F2630545B5E9A72503EB4D1CC005EA0A17FC98A526EA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

49274

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\gcloud\g\silent-frog-4440.hrmcxaeel.workers.dev\gv2\gv2.pdb

81360467b767c2eeada59a6b3946dd5baad78d947b5fc2e7b1695270939c23e2

mscoree

dotnet