asyncrat | 47165fbed4f743150ba8a41ee58d0df52b92a6c096e92192292adefb56195a81[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
47165fbed4f743150ba8a41ee58d0df52b92a6c096e92192292adefb56195a81.exe
Size 45KB
Sample260705-x9jpbsft2x
SHA256 47165fbed4f743150ba8a41ee58d0df52b92a6c096e92192292adefb56195a81
MD5 e23c85dc8f61416a1a4c84d49d164662
SHA1 90a3cbe440784186590badad31dce9dfb301ad12
SHA512 64cbd6fcfd04b8733ccb194d3157f152cdb4367ca3d49e9b0efefb3eedcb9cd105758b357f2690d9af9a72fed6c74d488c7a9386e8b3b67a9ab0db60b7757d98
SSDEEP 768:5udApTNctooWUS7C+mo2qtSCSwTMSPI5ljbcgX3iRcsO0LJ170KBDZ0x:5udApTNmU2lgG5tbzXSRHoUd0x
TLSH
T151232C0037E9812BF2BE4F78A9F26145867AF2673603D54A2CC441DB5723FC68A526FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexgaga.com:80
sexgaga.com:22
sexgaga.com:8080
sexgaga.com:8880
sexgaga.com:2052
sexgaga.com:2082
sexgaga.com:2086
sexgaga.com:2095
sexgaga.com:443
sexgaga.com:2053
sexgaga.com:2083
sexgaga.com:2087
sexgaga.com:2096
sexgaga.com:8443
www.sexgaga.com:80
www.sexgaga.com:22
www.sexgaga.com:8080
www.sexgaga.com:8880
www.sexgaga.com:2052
www.sexgaga.com:2082
www.sexgaga.com:2086
www.sexgaga.com:2095
www.sexgaga.com:443
www.sexgaga.com:2053
www.sexgaga.com:2083
www.sexgaga.com:2087
www.sexgaga.com:2096
www.sexgaga.com:8443
hermeticwiper.sexgaga.com:80
hermeticwiper.sexgaga.com:22
hermeticwiper.sexgaga.com:8080
hermeticwiper.sexgaga.com:8880
hermeticwiper.sexgaga.com:2052
hermeticwiper.sexgaga.com:2082
hermeticwiper.sexgaga.com:2086
hermeticwiper.sexgaga.com:2095
hermeticwiper.sexgaga.com:443
hermeticwiper.sexgaga.com:2053
hermeticwiper.sexgaga.com:2083
hermeticwiper.sexgaga.com:2087
hermeticwiper.sexgaga.com:2096
hermeticwiper.sexgaga.com:8443
rat.sexgaga.com:80
rat.sexgaga.com:22
rat.sexgaga.com:8080
rat.sexgaga.com:8880
rat.sexgaga.com:2052
rat.sexgaga.com:2082
rat.sexgaga.com:2086
rat.sexgaga.com:2095
rat.sexgaga.com:443
rat.sexgaga.com:2053
rat.sexgaga.com:2083
rat.sexgaga.com:2087
rat.sexgaga.com:2096
rat.sexgaga.com:8443

Mutex

hAIU53gV5kkA

Attributes

delay
0
install
true
install_file
cm1ow9.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
47165fbed4f743150ba8a41ee58d0df52b92a6c096e92192292adefb56195a81.exe

File Explorer

47165fbed4f743150ba8a41ee58d0df52b92a6c096e92192292adefb56195a81.exe

.exe 45KB

47165fbed4f743150ba8a41ee58d0df52b92a6c096e92192292adefb56195a81.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 47165fbed4f743150ba8a41ee58d0df52b92a6c096e92192292adefb56195a81
MD5 e23c85dc8f61416a1a4c84d49d164662
SHA1 90a3cbe440784186590badad31dce9dfb301ad12
SHA512 64cbd6fcfd04b8733ccb194d3157f152cdb4367ca3d49e9b0efefb3eedcb9cd105758b357f2690d9af9a72fed6c74d488c7a9386e8b3b67a9ab0db60b7757d98
SSDEEP 768:5udApTNctooWUS7C+mo2qtSCSwTMSPI5ljbcgX3iRcsO0LJ170KBDZ0x:5udApTNmU2lgG5tbzXSRHoUd0x
TLSH
T151232C0037E9812BF2BE4F78A9F26145867AF2673603D54A2CC441DB5723FC68A526FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

47165fbed4f743150ba8a41ee58d0df52b92a6c096e92192292adefb56195a81.exe

mscoree

dotnet