asyncrat | 4cda3b920ec9fc8acf6f740fd1b35f0c3a74188c5c3a6e807812ded8bfe01053

Sharing

Copy URL Twitter E-mail

General

Target
4cda3b920ec9fc8acf6f740fd1b35f0c3a74188c5c3a6e807812ded8bfe01053
Size 45KB
Sample260701-rtcceshz91
SHA256 4cda3b920ec9fc8acf6f740fd1b35f0c3a74188c5c3a6e807812ded8bfe01053
MD5 06e3e5fcd242223c15d85c8a1657f4fc
SHA1 69340143c91297090733addda77677e10e03d1ce
SHA512 b9414402183643f07a82f565873998e8c3cac0a1658dfd90625774724313393d52583856f060de16ec125217a5341049c8d09b42a6d90f76540bacc5fc6c6605
SSDEEP 768:Iu5KkpTsU6Q8WU+xjamo2q1RxJaxjwHuPI+zjbTgi3i449XGK0WluBDZLx:Iu5KkpTsx/24e+3+3bMiS4hRdLx
TLSH
T1D0233B003BE8852BF2BE4F7898F26145867AF2673603D5492CC451DB5723FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexzz.cc:80
sexzz.cc:22
sexzz.cc:8080
sexzz.cc:8880
sexzz.cc:2052
sexzz.cc:2082
sexzz.cc:2086
sexzz.cc:2095
sexzz.cc:443
sexzz.cc:2053
sexzz.cc:2083
sexzz.cc:2087
sexzz.cc:2096
sexzz.cc:8443
www.sexzz.cc:80
www.sexzz.cc:22
www.sexzz.cc:8080
www.sexzz.cc:8880
www.sexzz.cc:2052
www.sexzz.cc:2082
www.sexzz.cc:2086
www.sexzz.cc:2095
www.sexzz.cc:443
www.sexzz.cc:2053
www.sexzz.cc:2083
www.sexzz.cc:2087
www.sexzz.cc:2096
www.sexzz.cc:8443
qakbot.sexzz.cc:80
qakbot.sexzz.cc:22
qakbot.sexzz.cc:8080
qakbot.sexzz.cc:8880
qakbot.sexzz.cc:2052
qakbot.sexzz.cc:2082
qakbot.sexzz.cc:2086
qakbot.sexzz.cc:2095
qakbot.sexzz.cc:443
qakbot.sexzz.cc:2053
qakbot.sexzz.cc:2083
qakbot.sexzz.cc:2087
qakbot.sexzz.cc:2096
qakbot.sexzz.cc:8443
locky.sexzz.cc:80
locky.sexzz.cc:22
locky.sexzz.cc:8080
locky.sexzz.cc:8880
locky.sexzz.cc:2052
locky.sexzz.cc:2082
locky.sexzz.cc:2086
locky.sexzz.cc:2095
locky.sexzz.cc:443
locky.sexzz.cc:2053
locky.sexzz.cc:2083
locky.sexzz.cc:2087
locky.sexzz.cc:2096
locky.sexzz.cc:8443

Mutex

Af2Ac41U3k1G

Attributes

delay
0
install
true
install_file
0bx6rrvi.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4cda3b920ec9fc8acf6f740fd1b35f0c3a74188c5c3a6e807812ded8bfe01053

File Explorer

4cda3b920ec9fc8acf6f740fd1b35f0c3a74188c5c3a6e807812ded8bfe01053

.exe 45KB

4cda3b920ec9fc8acf6f740fd1b35f0c3a74188c5c3a6e807812ded8bfe01053

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4cda3b920ec9fc8acf6f740fd1b35f0c3a74188c5c3a6e807812ded8bfe01053
MD5 06e3e5fcd242223c15d85c8a1657f4fc
SHA1 69340143c91297090733addda77677e10e03d1ce
SHA512 b9414402183643f07a82f565873998e8c3cac0a1658dfd90625774724313393d52583856f060de16ec125217a5341049c8d09b42a6d90f76540bacc5fc6c6605
SSDEEP 768:Iu5KkpTsU6Q8WU+xjamo2q1RxJaxjwHuPI+zjbTgi3i449XGK0WluBDZLx:Iu5KkpTsx/24e+3+3bMiS4hRdLx
TLSH
T1D0233B003BE8852BF2BE4F7898F26145867AF2673603D5492CC451DB5723FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

4cda3b920ec9fc8acf6f740fd1b35f0c3a74188c5c3a6e807812ded8bfe01053

mscoree

dotnet