asyncrat | TrojanRAT[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
TrojanRAT.exe
Size 45KB
Sample260703-dvmb5aaz2w
SHA256 3c67272456a680b10b17c8cac6a0f3523b936f9dc616b4336511a477dbe9d31a
MD5 f4e4931d0fe0fb174d8f33ac64373f3f
SHA1 79a810731bec6cc2de378fda637d0fdad0c72cc2
SHA512 fb43b111d551d78a8bba56221792fcd0da39b57cac73e977f928a46df2f8aa32b80b069184a07ab9454395886376a67f75c715a98689a2ab54a6f6db5ddbc268
SSDEEP 768:FudIpTNctooWUS7C+mo2qtHe4MDFukPI9yjbhgX3i7+11Isx2BDZwx:FudIpTNmU2hlYJ9ebOXS7OxYdwx
TLSH
T14B232B003BE9822BF2BE4FB8ACF26145467AF5633603D59D1CC4419B5723BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat mb8coin.io asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

mb8coin.io

mb8coin.io:8443
mb8coin.io:81
mb8coin.io:7878
mb8coin.io:8787
mb8coin.io:6789
mb8coin.io:80
mb8coin.io:443
mb8coin.io:2525
mb8coin.io:7777
mb8coin.io:8181
mb8coin.io:8080
mb8coin.io:995
mb8coin.io:465
mb8coin.io:587
mb8coin.io:25
mb8coin.io:21
mb8coin.io:53
mb8coin.io:2929
mb8coin.io:4567
mb8coin.io:5678
www.mb8coin.io:8443
www.mb8coin.io:81
www.mb8coin.io:7878
www.mb8coin.io:8787
www.mb8coin.io:6789
www.mb8coin.io:80
www.mb8coin.io:443
www.mb8coin.io:2525
www.mb8coin.io:7777
www.mb8coin.io:8181
www.mb8coin.io:8080
www.mb8coin.io:995
www.mb8coin.io:465
www.mb8coin.io:587
www.mb8coin.io:25
www.mb8coin.io:21
www.mb8coin.io:53
www.mb8coin.io:2929
www.mb8coin.io:4567
www.mb8coin.io:5678
c2.mb8coin.io:8443
c2.mb8coin.io:81
c2.mb8coin.io:7878
c2.mb8coin.io:8787
c2.mb8coin.io:6789
c2.mb8coin.io:80
c2.mb8coin.io:443
c2.mb8coin.io:2525
c2.mb8coin.io:7777
c2.mb8coin.io:8181
c2.mb8coin.io:8080
c2.mb8coin.io:995
c2.mb8coin.io:465
c2.mb8coin.io:587
c2.mb8coin.io:25
c2.mb8coin.io:21
c2.mb8coin.io:53
c2.mb8coin.io:2929
c2.mb8coin.io:4567
c2.mb8coin.io:5678
malware.mb8coin.io:8443
malware.mb8coin.io:81
malware.mb8coin.io:7878
malware.mb8coin.io:8787
malware.mb8coin.io:6789
malware.mb8coin.io:80
malware.mb8coin.io:443
malware.mb8coin.io:2525
malware.mb8coin.io:7777
malware.mb8coin.io:8181
malware.mb8coin.io:8080
malware.mb8coin.io:995
malware.mb8coin.io:465
malware.mb8coin.io:587
malware.mb8coin.io:25
malware.mb8coin.io:21
malware.mb8coin.io:53
malware.mb8coin.io:2929
malware.mb8coin.io:4567
malware.mb8coin.io:5678

Mutex

ua4oPG4sD2Ff

Attributes

delay
3
install
false
install_file
winrar.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TrojanRAT.exe

File Explorer

TrojanRAT.exe

.exe 45KB

TrojanRAT.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3c67272456a680b10b17c8cac6a0f3523b936f9dc616b4336511a477dbe9d31a
MD5 f4e4931d0fe0fb174d8f33ac64373f3f
SHA1 79a810731bec6cc2de378fda637d0fdad0c72cc2
SHA512 fb43b111d551d78a8bba56221792fcd0da39b57cac73e977f928a46df2f8aa32b80b069184a07ab9454395886376a67f75c715a98689a2ab54a6f6db5ddbc268
SSDEEP 768:FudIpTNctooWUS7C+mo2qtHe4MDFukPI9yjbhgX3i7+11Isx2BDZwx:FudIpTNmU2hlYJ9ebOXS7OxYdwx
TLSH
T14B232B003BE9822BF2BE4FB8ACF26145467AF5633603D59D1CC4419B5723BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

TrojanRAT.exe

mscoree

dotnet