asyncrat | 68c41a6f8053db494a5d8a39dff0f4ae75adda27242e506ae65a1eeff8c1489e

Sharing

Copy URL Twitter E-mail

General

Target
68c41a6f8053db494a5d8a39dff0f4ae75adda27242e506ae65a1eeff8c1489e
Size 45KB
Sample260703-mcdfyaft2z
SHA256 68c41a6f8053db494a5d8a39dff0f4ae75adda27242e506ae65a1eeff8c1489e
MD5 4ece753b32b8d47b23b02601d52f0c2f
SHA1 60b52cf7ee4492274dd4d630f8376064417b34b7
SHA512 72d7ba179877ca288e4aa037f2f43a861d9e8c981d9e0274039626335928b521bd9a661c6aa15ad6975d7a1a0ffb4432420d3ab4f46b24882fdb2b27647d673e
SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1x0ewtDc30oiZPI/zjbQgX3ipycjZBV8RIBDZMx:wuZ8pT1tc24wR2iW/3bXXSpj98gdMx
TLSH
T1BB232A003BE8812BF2BE4F7859F26145867AF2673603D5491CC451DB5A23FC69A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

myzoomboom.com:80
myzoomboom.com:22
myzoomboom.com:8080
myzoomboom.com:8880
myzoomboom.com:2052
myzoomboom.com:2082
myzoomboom.com:2086
myzoomboom.com:2095
myzoomboom.com:443
myzoomboom.com:2053
myzoomboom.com:2083
myzoomboom.com:2087
myzoomboom.com:2096
myzoomboom.com:8443
www.myzoomboom.com:80
www.myzoomboom.com:22
www.myzoomboom.com:8080
www.myzoomboom.com:8880
www.myzoomboom.com:2052
www.myzoomboom.com:2082
www.myzoomboom.com:2086
www.myzoomboom.com:2095
www.myzoomboom.com:443
www.myzoomboom.com:2053
www.myzoomboom.com:2083
www.myzoomboom.com:2087
www.myzoomboom.com:2096
www.myzoomboom.com:8443
mirai.myzoomboom.com:80
mirai.myzoomboom.com:22
mirai.myzoomboom.com:8080
mirai.myzoomboom.com:8880
mirai.myzoomboom.com:2052
mirai.myzoomboom.com:2082
mirai.myzoomboom.com:2086
mirai.myzoomboom.com:2095
mirai.myzoomboom.com:443
mirai.myzoomboom.com:2053
mirai.myzoomboom.com:2083
mirai.myzoomboom.com:2087
mirai.myzoomboom.com:2096
mirai.myzoomboom.com:8443
codered.myzoomboom.com:80
codered.myzoomboom.com:22
codered.myzoomboom.com:8080
codered.myzoomboom.com:8880
codered.myzoomboom.com:2052
codered.myzoomboom.com:2082
codered.myzoomboom.com:2086
codered.myzoomboom.com:2095
codered.myzoomboom.com:443
codered.myzoomboom.com:2053
codered.myzoomboom.com:2083
codered.myzoomboom.com:2087
codered.myzoomboom.com:2096
codered.myzoomboom.com:8443

Mutex

PBDiPTYC2hAD

Attributes

delay
0
install
true
install_file
isif.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68c41a6f8053db494a5d8a39dff0f4ae75adda27242e506ae65a1eeff8c1489e

File Explorer

68c41a6f8053db494a5d8a39dff0f4ae75adda27242e506ae65a1eeff8c1489e

.exe 45KB

68c41a6f8053db494a5d8a39dff0f4ae75adda27242e506ae65a1eeff8c1489e

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 68c41a6f8053db494a5d8a39dff0f4ae75adda27242e506ae65a1eeff8c1489e
MD5 4ece753b32b8d47b23b02601d52f0c2f
SHA1 60b52cf7ee4492274dd4d630f8376064417b34b7
SHA512 72d7ba179877ca288e4aa037f2f43a861d9e8c981d9e0274039626335928b521bd9a661c6aa15ad6975d7a1a0ffb4432420d3ab4f46b24882fdb2b27647d673e
SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1x0ewtDc30oiZPI/zjbQgX3ipycjZBV8RIBDZMx:wuZ8pT1tc24wR2iW/3bXXSpj98gdMx
TLSH
T1BB232A003BE8812BF2BE4F7859F26145867AF2673603D5491CC451DB5A23FC69A43AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

68c41a6f8053db494a5d8a39dff0f4ae75adda27242e506ae65a1eeff8c1489e

mscoree

dotnet