asyncrat | AsyncClient[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AsyncClient.exe
Size 45KB
Sample260703-lf8ktaev91
SHA256 76bdce033e64780b6165eca728d0b170b322e9a7af10d9d165966d0cfb57f1e0
MD5 30ce62922dbfc7a4451238e06d958f76
SHA1 efe55b76f3e0f1f767183b877424ef52580e9fc9
SHA512 2216c0c1dbf1a1aabf17a0f9be0a300671d1713de7f893947948532529b3665cd3a4cea3fa908475c0f914d95cd4fc6cf8fe1f820b5328c84031524da4fff79e
SSDEEP 768:EutPpTXkKYYWUiMAmOmo2qNGKjPGaG6PIyzjbFgX3iFYITuTxcoBDZsx:EutPpTXds25KTkDy3bCXStwxcOdsx
TLSH
T18D231C003BE8822BF2BE5B78ACF26145867AF5636603D54E1CC451DB5723FC64A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat burggraven.nl asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

burggraven.nl

fun88mb5.com:8443
fun88mb5.com:81
fun88mb5.com:7878
fun88mb5.com:8787
fun88mb5.com:6789
fun88mb5.com:80
fun88mb5.com:443
fun88mb5.com:2525
fun88mb5.com:7777
fun88mb5.com:8181
fun88mb5.com:8080
fun88mb5.com:995
fun88mb5.com:465
fun88mb5.com:587
fun88mb5.com:25
fun88mb5.com:21
fun88mb5.com:53
fun88mb5.com:2929
fun88mb5.com:4567
fun88mb5.com:5678
www.fun88mb5.com:8443
www.fun88mb5.com:81
www.fun88mb5.com:7878
www.fun88mb5.com:8787
www.fun88mb5.com:6789
www.fun88mb5.com:80
www.fun88mb5.com:443
www.fun88mb5.com:2525
www.fun88mb5.com:7777
www.fun88mb5.com:8181
www.fun88mb5.com:8080
www.fun88mb5.com:995
www.fun88mb5.com:465
www.fun88mb5.com:587
www.fun88mb5.com:25
www.fun88mb5.com:21
www.fun88mb5.com:53
www.fun88mb5.com:2929
www.fun88mb5.com:4567
www.fun88mb5.com:5678
botnet.fun88mb5.com:8443
botnet.fun88mb5.com:81
botnet.fun88mb5.com:7878
botnet.fun88mb5.com:8787
botnet.fun88mb5.com:6789
botnet.fun88mb5.com:80
botnet.fun88mb5.com:443
botnet.fun88mb5.com:2525
botnet.fun88mb5.com:7777
botnet.fun88mb5.com:8181
botnet.fun88mb5.com:8080
botnet.fun88mb5.com:995
botnet.fun88mb5.com:465
botnet.fun88mb5.com:587
botnet.fun88mb5.com:25
botnet.fun88mb5.com:21
botnet.fun88mb5.com:53
botnet.fun88mb5.com:2929
botnet.fun88mb5.com:4567
botnet.fun88mb5.com:5678
c2.fun88mb5.com:8443
c2.fun88mb5.com:81
c2.fun88mb5.com:7878
c2.fun88mb5.com:8787
c2.fun88mb5.com:6789
c2.fun88mb5.com:80
c2.fun88mb5.com:443
c2.fun88mb5.com:2525
c2.fun88mb5.com:7777
c2.fun88mb5.com:8181
c2.fun88mb5.com:8080
c2.fun88mb5.com:995
c2.fun88mb5.com:465
c2.fun88mb5.com:587
c2.fun88mb5.com:25
c2.fun88mb5.com:21
c2.fun88mb5.com:53
c2.fun88mb5.com:2929
c2.fun88mb5.com:4567
c2.fun88mb5.com:5678
backdoor.fun88mb5.com:8443
backdoor.fun88mb5.com:81
backdoor.fun88mb5.com:7878
backdoor.fun88mb5.com:8787
backdoor.fun88mb5.com:6789
backdoor.fun88mb5.com:80
backdoor.fun88mb5.com:443
backdoor.fun88mb5.com:2525
backdoor.fun88mb5.com:7777
backdoor.fun88mb5.com:8181
backdoor.fun88mb5.com:8080
backdoor.fun88mb5.com:995
backdoor.fun88mb5.com:465
backdoor.fun88mb5.com:587
backdoor.fun88mb5.com:25
backdoor.fun88mb5.com:21
backdoor.fun88mb5.com:53
backdoor.fun88mb5.com:2929
backdoor.fun88mb5.com:4567
backdoor.fun88mb5.com:5678

Mutex

9oBhywbhGLDV

Attributes

delay
3
install
false
install_file
winrar.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AsyncClient.exe

File Explorer

AsyncClient.exe

.exe 45KB

AsyncClient.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 76bdce033e64780b6165eca728d0b170b322e9a7af10d9d165966d0cfb57f1e0
MD5 30ce62922dbfc7a4451238e06d958f76
SHA1 efe55b76f3e0f1f767183b877424ef52580e9fc9
SHA512 2216c0c1dbf1a1aabf17a0f9be0a300671d1713de7f893947948532529b3665cd3a4cea3fa908475c0f914d95cd4fc6cf8fe1f820b5328c84031524da4fff79e
SSDEEP 768:EutPpTXkKYYWUiMAmOmo2qNGKjPGaG6PIyzjbFgX3iFYITuTxcoBDZsx:EutPpTXds25KTkDy3bCXStwxcOdsx
TLSH
T18D231C003BE8822BF2BE5B78ACF26145867AF5636603D54E1CC451DB5723FC64A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

AsyncClient.exe

mscoree

dotnet