asyncrat | dev[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
dev.exe
Size 407KB
Sample260511-xplcesct7j
SHA256 6325456a357e575cec9833a14592834380fcc2c60ec1b1a365018d0c60a0e9d3
MD5 0ea4af2268c7a94f3d384515fd11dd4f
SHA1 753652605147603b10a30bde53621e77120bd725
SHA512 77316686eba5b1c042e43bda5f51f163e81ac901c8d4a5d327c919c90694d096331ab51efcae6f0e5cb4ae383b13a478b921ef2ba1670ef541aa59293f181de2
SSDEEP 1536:uuqKpTTWJ29/cUsOU43beXSGN78VSdmuxwo4uxg/uSx1:uuqiTTWJ29kUpU43be11C9uD81
TLSH
T18D94A32037E4F02AE5AE5A759F96F0B412757D562E42C65238CC73CF353EE8188393A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat dev asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

viet69.vg:443
viet69.vg:80
viet69.vg:53
viet69.vg:43
viet69.vg:8888
viet69.vg:8080
cdn.viet69.vg:443
cdn.viet69.vg:80
cdn.viet69.vg:53
cdn.viet69.vg:43
cdn.viet69.vg:8888
cdn.viet69.vg:8080
img.viet69.vg:443
img.viet69.vg:80
img.viet69.vg:53
img.viet69.vg:43
img.viet69.vg:8888
img.viet69.vg:8080
www.viet69.vg:443
www.viet69.vg:80
www.viet69.vg:53
www.viet69.vg:43
www.viet69.vg:8888
www.viet69.vg:8080
sextop1.cafe:443
sextop1.cafe:80
sextop1.cafe:53
sextop1.cafe:43
sextop1.cafe:8888
sextop1.cafe:8080
admin.sextop1.cafe:443
admin.sextop1.cafe:80
admin.sextop1.cafe:53
admin.sextop1.cafe:43
admin.sextop1.cafe:8888
admin.sextop1.cafe:8080
backend.sextop1.cafe:443
backend.sextop1.cafe:80
backend.sextop1.cafe:53
backend.sextop1.cafe:43
backend.sextop1.cafe:8888
backend.sextop1.cafe:8080
dev.sextop1.cafe:443
dev.sextop1.cafe:80
dev.sextop1.cafe:53
dev.sextop1.cafe:43
dev.sextop1.cafe:8888
dev.sextop1.cafe:8080
af88.life:443
af88.life:80
af88.life:53
af88.life:43
af88.life:8888
af88.life:8080
172.67.177.99:443
172.67.177.99:80
172.67.177.99:53
172.67.177.99:43
172.67.177.99:8888
172.67.177.99:8080
104.21.51.79:443
104.21.51.79:80
104.21.51.79:53
104.21.51.79:43
104.21.51.79:8888
104.21.51.79:8080
94.154.172.236:443
94.154.172.236:80
94.154.172.236:53
94.154.172.236:43
94.154.172.236:8888
94.154.172.236:8080
199.59.243.226:443
199.59.243.226:80
199.59.243.226:53
199.59.243.226:43
199.59.243.226:8888
199.59.243.226:8080
91.195.240.123:443
91.195.240.123:80
91.195.240.123:53
91.195.240.123:43
91.195.240.123:8888
91.195.240.123:8080
198.54.117.215:443
198.54.117.215:80
198.54.117.215:53
198.54.117.215:43
198.54.117.215:8888
198.54.117.215:8080

Mutex

SbWU4voLVPfv

Attributes

delay
3
install
true
install_file
dev.exe
install_folder
%Temp%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dev.exe

File Explorer

dev.exe

.exe 407KB

dev.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6325456a357e575cec9833a14592834380fcc2c60ec1b1a365018d0c60a0e9d3
MD5 0ea4af2268c7a94f3d384515fd11dd4f
SHA1 753652605147603b10a30bde53621e77120bd725
SHA512 77316686eba5b1c042e43bda5f51f163e81ac901c8d4a5d327c919c90694d096331ab51efcae6f0e5cb4ae383b13a478b921ef2ba1670ef541aa59293f181de2
SSDEEP 1536:uuqKpTTWJ29/cUsOU43beXSGN78VSdmuxwo4uxg/uSx1:uuqiTTWJ29kUpU43be11C9uD81
TLSH
T18D94A32037E4F02AE5AE5A759F96F0B412757D562E42C65238CC73CF353EE8188393A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

dev.exe

mscoree

dotnet