asyncrat | 1a4631b6e339e2c7feb61e01b88b72cf0011dea52391c09a27c8e500c7f989a4

Sharing

Copy URL Twitter E-mail

General

Target
1a4631b6e339e2c7feb61e01b88b72cf0011dea52391c09a27c8e500c7f989a4
Size 45KB
Sample260606-xtargsb14k
SHA256 1a4631b6e339e2c7feb61e01b88b72cf0011dea52391c09a27c8e500c7f989a4
MD5 4b99d4a00aa7a6dc088b38ad45a99f25
SHA1 89e002c8b71977fa6f5d69fbee8da4b654c7c168
SHA512 4083acb2ae3fb63f837e5882c56896c68f7bdf7727ae2a9becdd1fa788f049bf76ad246fe25610238f207d92efcbdb48d3f588ec5de5d66911655a608f2ff5bc
SSDEEP 768:5udIpTNctooWUS7C+mo2qtk5VNNKbCOPIMyzjbwgX3K0kNhRicfeUFXAr4kBDZ0x:5udIpTNmU2blAu3My3b3Xa0kzrA/d0x
TLSH
T137232B0037E8822BF2BE4F78A9F26145867AF6633603D58E1CC451DB5613FC59A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexviet88s.blog:5367
sexviet88s.blog:7707
sexviet88s.blog:4468
sexviet88s.blog:8832
sexviet88s.blog:2257
sexviet88s.blog:1729
sexviet88s.blog:9527
sexviet88s.blog:1344
sexviet88s.blog:8562
www.sexviet88s.blog:5367
www.sexviet88s.blog:7707
www.sexviet88s.blog:4468
www.sexviet88s.blog:8832
www.sexviet88s.blog:2257
www.sexviet88s.blog:1729
www.sexviet88s.blog:9527
www.sexviet88s.blog:1344
www.sexviet88s.blog:8562
lokibot.sexviet88s.blog:5367
lokibot.sexviet88s.blog:7707
lokibot.sexviet88s.blog:4468
lokibot.sexviet88s.blog:8832
lokibot.sexviet88s.blog:2257
lokibot.sexviet88s.blog:1729
lokibot.sexviet88s.blog:9527
lokibot.sexviet88s.blog:1344
lokibot.sexviet88s.blog:8562
fakeupdates.sexviet88s.blog:5367
fakeupdates.sexviet88s.blog:7707
fakeupdates.sexviet88s.blog:4468
fakeupdates.sexviet88s.blog:8832
fakeupdates.sexviet88s.blog:2257
fakeupdates.sexviet88s.blog:1729
fakeupdates.sexviet88s.blog:9527
fakeupdates.sexviet88s.blog:1344
fakeupdates.sexviet88s.blog:8562
sobig.sexviet88s.blog:5367
sobig.sexviet88s.blog:7707
sobig.sexviet88s.blog:4468
sobig.sexviet88s.blog:8832
sobig.sexviet88s.blog:2257
sobig.sexviet88s.blog:1729
sobig.sexviet88s.blog:9527
sobig.sexviet88s.blog:1344
sobig.sexviet88s.blog:8562

Mutex

FZjYpFO4CUzw

Attributes

delay
0
install
true
install_file
jc6ags.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a4631b6e339e2c7feb61e01b88b72cf0011dea52391c09a27c8e500c7f989a4

File Explorer

1a4631b6e339e2c7feb61e01b88b72cf0011dea52391c09a27c8e500c7f989a4

.exe 45KB

1a4631b6e339e2c7feb61e01b88b72cf0011dea52391c09a27c8e500c7f989a4

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1a4631b6e339e2c7feb61e01b88b72cf0011dea52391c09a27c8e500c7f989a4
MD5 4b99d4a00aa7a6dc088b38ad45a99f25
SHA1 89e002c8b71977fa6f5d69fbee8da4b654c7c168
SHA512 4083acb2ae3fb63f837e5882c56896c68f7bdf7727ae2a9becdd1fa788f049bf76ad246fe25610238f207d92efcbdb48d3f588ec5de5d66911655a608f2ff5bc
SSDEEP 768:5udIpTNctooWUS7C+mo2qtk5VNNKbCOPIMyzjbwgX3K0kNhRicfeUFXAr4kBDZ0x:5udIpTNmU2blAu3My3b3Xa0kzrA/d0x
TLSH
T137232B0037E8822BF2BE4F78A9F26145867AF6633603D58E1CC451DB5613FC59A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

1a4631b6e339e2c7feb61e01b88b72cf0011dea52391c09a27c8e500c7f989a4

mscoree

dotnet