asyncrat | 9e8fbb186dfc4432c9e85adb3d3a5a9d88cf112d0b8f3743a4ff6cc471c40802

Sharing

Copy URL Twitter E-mail

General

Target
9e8fbb186dfc4432c9e85adb3d3a5a9d88cf112d0b8f3743a4ff6cc471c40802
Size 45KB
Sample260703-raba1sav3w
SHA256 9e8fbb186dfc4432c9e85adb3d3a5a9d88cf112d0b8f3743a4ff6cc471c40802
MD5 c6b06aa01d502af2ac02ef1fcf271f33
SHA1 4f906a85cb6b2bb2c4b1eeb9aff114a767c010be
SHA512 ee794cf43f24b595abd3ededffa0e2aaf0c2bd98f6f2108f6f776c34b2ce806f64c964e74f38c0e091fd38296b8fcd18718ff78a7f95c188bf3e04b8be2b05d7
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1wpt0CCM+d4CvS8PIkBjbAgX3iaTWwal6BDZUx:cuR0JTPjY2p/CFWBkRbnXSeWwaCdUx
TLSH
T1F5231A1037E9812BF2BE4F78A9F26245467BF6633603D54A1CC441DB5B23BC68A436ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cuongsex.com:80
cuongsex.com:22
cuongsex.com:8080
cuongsex.com:8880
cuongsex.com:2052
cuongsex.com:2082
cuongsex.com:2086
cuongsex.com:2095
cuongsex.com:443
cuongsex.com:2053
cuongsex.com:2083
cuongsex.com:2087
cuongsex.com:2096
cuongsex.com:8443
www.cuongsex.com:80
www.cuongsex.com:22
www.cuongsex.com:8080
www.cuongsex.com:8880
www.cuongsex.com:2052
www.cuongsex.com:2082
www.cuongsex.com:2086
www.cuongsex.com:2095
www.cuongsex.com:443
www.cuongsex.com:2053
www.cuongsex.com:2083
www.cuongsex.com:2087
www.cuongsex.com:2096
www.cuongsex.com:8443
conti.cuongsex.com:80
conti.cuongsex.com:22
conti.cuongsex.com:8080
conti.cuongsex.com:8880
conti.cuongsex.com:2052
conti.cuongsex.com:2082
conti.cuongsex.com:2086
conti.cuongsex.com:2095
conti.cuongsex.com:443
conti.cuongsex.com:2053
conti.cuongsex.com:2083
conti.cuongsex.com:2087
conti.cuongsex.com:2096
conti.cuongsex.com:8443
gootloader.cuongsex.com:80
gootloader.cuongsex.com:22
gootloader.cuongsex.com:8080
gootloader.cuongsex.com:8880
gootloader.cuongsex.com:2052
gootloader.cuongsex.com:2082
gootloader.cuongsex.com:2086
gootloader.cuongsex.com:2095
gootloader.cuongsex.com:443
gootloader.cuongsex.com:2053
gootloader.cuongsex.com:2083
gootloader.cuongsex.com:2087
gootloader.cuongsex.com:2096
gootloader.cuongsex.com:8443
zeus.cuongsex.com:80
zeus.cuongsex.com:22
zeus.cuongsex.com:8080
zeus.cuongsex.com:8880
zeus.cuongsex.com:2052
zeus.cuongsex.com:2082
zeus.cuongsex.com:2086
zeus.cuongsex.com:2095
zeus.cuongsex.com:443
zeus.cuongsex.com:2053
zeus.cuongsex.com:2083
zeus.cuongsex.com:2087
zeus.cuongsex.com:2096
zeus.cuongsex.com:8443

Mutex

2H91O4B4mCv9

Attributes

delay
0
install
true
install_file
k5zb.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9e8fbb186dfc4432c9e85adb3d3a5a9d88cf112d0b8f3743a4ff6cc471c40802

File Explorer

9e8fbb186dfc4432c9e85adb3d3a5a9d88cf112d0b8f3743a4ff6cc471c40802

.exe 45KB

9e8fbb186dfc4432c9e85adb3d3a5a9d88cf112d0b8f3743a4ff6cc471c40802

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9e8fbb186dfc4432c9e85adb3d3a5a9d88cf112d0b8f3743a4ff6cc471c40802
MD5 c6b06aa01d502af2ac02ef1fcf271f33
SHA1 4f906a85cb6b2bb2c4b1eeb9aff114a767c010be
SHA512 ee794cf43f24b595abd3ededffa0e2aaf0c2bd98f6f2108f6f776c34b2ce806f64c964e74f38c0e091fd38296b8fcd18718ff78a7f95c188bf3e04b8be2b05d7
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1wpt0CCM+d4CvS8PIkBjbAgX3iaTWwal6BDZUx:cuR0JTPjY2p/CFWBkRbnXSeWwaCdUx
TLSH
T1F5231A1037E9812BF2BE4F78A9F26245467BF6633603D54A1CC441DB5B23BC68A436ED
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

9e8fbb186dfc4432c9e85adb3d3a5a9d88cf112d0b8f3743a4ff6cc471c40802

mscoree

dotnet