asyncrat | b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7

Sharing

Copy URL Twitter E-mail

General

Target
b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7
Size 45KB
Sample260701-m7le2act7l
SHA256 b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7
MD5 67103094939af22b6ac429b6a07b0bc6
SHA1 7315146addf96d26d244666ef23c662bd10b7973
SHA512 8658e7a2e2224f487ab498dd8b6213567e80bf1ecaa09626766e7e1afb2fcb40b43d8ffa1b9fb9ecf72e3cf84383ad589578989df6669367d222594f596c9813
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1yp7EcPIpzjbMgX3ik/7FmzV/V8Z//dpBDZEx:MuBGJTPho2t8V41Ehp3bDXSk/szS//ZE
TLSH
T13D2319003BE9822BF2BE4FB899F26185867BF2633603D64D2CC451975613BC6D6426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sextop68.com:80
sextop68.com:22
sextop68.com:8080
sextop68.com:8880
sextop68.com:2052
sextop68.com:2082
sextop68.com:2086
sextop68.com:2095
sextop68.com:443
sextop68.com:2053
sextop68.com:2083
sextop68.com:2087
sextop68.com:2096
sextop68.com:8443
www.sextop68.com:80
www.sextop68.com:22
www.sextop68.com:8080
www.sextop68.com:8880
www.sextop68.com:2052
www.sextop68.com:2082
www.sextop68.com:2086
www.sextop68.com:2095
www.sextop68.com:443
www.sextop68.com:2053
www.sextop68.com:2083
www.sextop68.com:2087
www.sextop68.com:2096
www.sextop68.com:8443
mirai.sextop68.com:80
mirai.sextop68.com:22
mirai.sextop68.com:8080
mirai.sextop68.com:8880
mirai.sextop68.com:2052
mirai.sextop68.com:2082
mirai.sextop68.com:2086
mirai.sextop68.com:2095
mirai.sextop68.com:443
mirai.sextop68.com:2053
mirai.sextop68.com:2083
mirai.sextop68.com:2087
mirai.sextop68.com:2096
mirai.sextop68.com:8443
locky.sextop68.com:80
locky.sextop68.com:22
locky.sextop68.com:8080
locky.sextop68.com:8880
locky.sextop68.com:2052
locky.sextop68.com:2082
locky.sextop68.com:2086
locky.sextop68.com:2095
locky.sextop68.com:443
locky.sextop68.com:2053
locky.sextop68.com:2083
locky.sextop68.com:2087
locky.sextop68.com:2096
locky.sextop68.com:8443
invasive.sextop68.com:80
invasive.sextop68.com:22
invasive.sextop68.com:8080
invasive.sextop68.com:8880
invasive.sextop68.com:2052
invasive.sextop68.com:2082
invasive.sextop68.com:2086
invasive.sextop68.com:2095
invasive.sextop68.com:443
invasive.sextop68.com:2053
invasive.sextop68.com:2083
invasive.sextop68.com:2087
invasive.sextop68.com:2096
invasive.sextop68.com:8443
sobig.sextop68.com:80
sobig.sextop68.com:22
sobig.sextop68.com:8080
sobig.sextop68.com:8880
sobig.sextop68.com:2052
sobig.sextop68.com:2082
sobig.sextop68.com:2086
sobig.sextop68.com:2095
sobig.sextop68.com:443
sobig.sextop68.com:2053
sobig.sextop68.com:2083
sobig.sextop68.com:2087
sobig.sextop68.com:2096
sobig.sextop68.com:8443

Mutex

M6aDXC58N9Fz

Attributes

delay
0
install
true
install_file
pxyw.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7

File Explorer

b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7

.exe 45KB

b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7
MD5 67103094939af22b6ac429b6a07b0bc6
SHA1 7315146addf96d26d244666ef23c662bd10b7973
SHA512 8658e7a2e2224f487ab498dd8b6213567e80bf1ecaa09626766e7e1afb2fcb40b43d8ffa1b9fb9ecf72e3cf84383ad589578989df6669367d222594f596c9813
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1yp7EcPIpzjbMgX3ik/7FmzV/V8Z//dpBDZEx:MuBGJTPho2t8V41Ehp3bDXSk/szS//ZE
TLSH
T13D2319003BE9822BF2BE4FB899F26185867BF2633603D64D2CC451975613BC6D6426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

b354fb520b9cb082a1757caf7ffeec761062cd0a8676d85b7f109059836d93d7

mscoree

dotnet