asyncrat | AsyncClient[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AsyncClient.exe
Size 45KB
Sample260701-ce5yvsct7p
SHA256 ddb872466864ca93ea0f806f4a0d6e1669708ea84f08897e9b64f23c6c4a7a36
MD5 bc67dbc1db27435fe59d98c042584eb6
SHA1 4a389ab91170af05798791910d1a9ad25936504e
SHA512 56309a922b701d22ea6b03c140cfe99c43628c4107c0fc16269917ee6afdb45e81c7e2f716a057853ffc75ac168cbcd8f528c41fadd2d6ce16e32c65412dac7b
SSDEEP 768:IuW0RT8gaQ65WU9h7Amo2q9lOjPGagAWOzjbFgX3iJiD+9Q6AQ5mcDZ6f+:IuW0RT8nQJ22OTKTO3bCXSJ3gkJd6f+
TLSH
T111233C103BE8C22BF2BE4FB899F261454A7AF6732603D54D1CC441DB5613FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

onlineticketexpress.de:6606
onlineticketexpress.de:7707
onlineticketexpress.de:8808
onlineticketexpress.de:443
onlineticketexpress.de:80
onlineticketexpress.de:8844
onlineticketexpress.de:22
onlineticketexpress.de:53
ccconsulting.org.uk:6606
ccconsulting.org.uk:7707
ccconsulting.org.uk:8808
ccconsulting.org.uk:443
ccconsulting.org.uk:80
ccconsulting.org.uk:8844
ccconsulting.org.uk:22
ccconsulting.org.uk:53
actueelin.nl:6606
actueelin.nl:7707
actueelin.nl:8808
actueelin.nl:443
actueelin.nl:80
actueelin.nl:8844
actueelin.nl:22
actueelin.nl:53
gorecht5.nl:6606
gorecht5.nl:7707
gorecht5.nl:8808
gorecht5.nl:443
gorecht5.nl:80
gorecht5.nl:8844
gorecht5.nl:22
gorecht5.nl:53
computare.com.co:6606
computare.com.co:7707
computare.com.co:8808
computare.com.co:443
computare.com.co:80
computare.com.co:8844
computare.com.co:22
computare.com.co:53
taixiu68.buzz:6606
taixiu68.buzz:7707
taixiu68.buzz:8808
taixiu68.buzz:443
taixiu68.buzz:80
taixiu68.buzz:8844
taixiu68.buzz:22
taixiu68.buzz:53
123bb.buzz:6606
123bb.buzz:7707
123bb.buzz:8808
123bb.buzz:443
123bb.buzz:80
123bb.buzz:8844
123bb.buzz:22
123bb.buzz:53

Mutex

hnJa6C6W3Dno

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AsyncClient.exe

File Explorer

AsyncClient.exe

.exe 45KB

AsyncClient.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ddb872466864ca93ea0f806f4a0d6e1669708ea84f08897e9b64f23c6c4a7a36
MD5 bc67dbc1db27435fe59d98c042584eb6
SHA1 4a389ab91170af05798791910d1a9ad25936504e
SHA512 56309a922b701d22ea6b03c140cfe99c43628c4107c0fc16269917ee6afdb45e81c7e2f716a057853ffc75ac168cbcd8f528c41fadd2d6ce16e32c65412dac7b
SSDEEP 768:IuW0RT8gaQ65WU9h7Amo2q9lOjPGagAWOzjbFgX3iJiD+9Q6AQ5mcDZ6f+:IuW0RT8nQJ22OTKTO3bCXSJ3gkJd6f+
TLSH
T111233C103BE8C22BF2BE4FB899F261454A7AF6732603D54D1CC441DB5613FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

AsyncClient.exe

mscoree

dotnet