asyncrat | a952de0a4ffcd41fe0a7ec431d3c7d682104cb7110c39b5e2cbb8a5b947a96de

Sharing

Copy URL Twitter E-mail

General

Target
a952de0a4ffcd41fe0a7ec431d3c7d682104cb7110c39b5e2cbb8a5b947a96de
Size 45KB
Sample260706-epp2hahw4v
SHA256 a952de0a4ffcd41fe0a7ec431d3c7d682104cb7110c39b5e2cbb8a5b947a96de
MD5 d375ad8ae0796c759ce6ab49caf92970
SHA1 2c4ff44ceed917daf1dc310e52388638b0803cb8
SHA512 91b768a784f25d0f4c51f3891a0a99d17cc99f735a4a249d54e3a5224ecf0f08bef8291c68994511a535204b42996aa33076ff729e0eaf42a5b4de7a753430fd
SSDEEP 768:DuAqJT84XVvWUXR1Zmo2qjL9Yq3q3hOPI2zjbQgX3iE/BmEtvAyPvCxBDZcx:DuAqJT84v2AaCq323bXXS6mEKavCPdcx
TLSH
T1D0232A103BE8C12BF2BE4FB89CF26245467AF2633603D6491CC4519A5713BC6DA526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xemphimxxxviet.com:80
xemphimxxxviet.com:22
xemphimxxxviet.com:8080
xemphimxxxviet.com:8880
xemphimxxxviet.com:2052
xemphimxxxviet.com:2082
xemphimxxxviet.com:2086
xemphimxxxviet.com:2095
xemphimxxxviet.com:443
xemphimxxxviet.com:2053
xemphimxxxviet.com:2083
xemphimxxxviet.com:2087
xemphimxxxviet.com:2096
xemphimxxxviet.com:8443
www.xemphimxxxviet.com:80
www.xemphimxxxviet.com:22
www.xemphimxxxviet.com:8080
www.xemphimxxxviet.com:8880
www.xemphimxxxviet.com:2052
www.xemphimxxxviet.com:2082
www.xemphimxxxviet.com:2086
www.xemphimxxxviet.com:2095
www.xemphimxxxviet.com:443
www.xemphimxxxviet.com:2053
www.xemphimxxxviet.com:2083
www.xemphimxxxviet.com:2087
www.xemphimxxxviet.com:2096
www.xemphimxxxviet.com:8443
blacklotus.xemphimxxxviet.com:80
blacklotus.xemphimxxxviet.com:22
blacklotus.xemphimxxxviet.com:8080
blacklotus.xemphimxxxviet.com:8880
blacklotus.xemphimxxxviet.com:2052
blacklotus.xemphimxxxviet.com:2082
blacklotus.xemphimxxxviet.com:2086
blacklotus.xemphimxxxviet.com:2095
blacklotus.xemphimxxxviet.com:443
blacklotus.xemphimxxxviet.com:2053
blacklotus.xemphimxxxviet.com:2083
blacklotus.xemphimxxxviet.com:2087
blacklotus.xemphimxxxviet.com:2096
blacklotus.xemphimxxxviet.com:8443
revil.xemphimxxxviet.com:80
revil.xemphimxxxviet.com:22
revil.xemphimxxxviet.com:8080
revil.xemphimxxxviet.com:8880
revil.xemphimxxxviet.com:2052
revil.xemphimxxxviet.com:2082
revil.xemphimxxxviet.com:2086
revil.xemphimxxxviet.com:2095
revil.xemphimxxxviet.com:443
revil.xemphimxxxviet.com:2053
revil.xemphimxxxviet.com:2083
revil.xemphimxxxviet.com:2087
revil.xemphimxxxviet.com:2096
revil.xemphimxxxviet.com:8443
invasive.xemphimxxxviet.com:80
invasive.xemphimxxxviet.com:22
invasive.xemphimxxxviet.com:8080
invasive.xemphimxxxviet.com:8880
invasive.xemphimxxxviet.com:2052
invasive.xemphimxxxviet.com:2082
invasive.xemphimxxxviet.com:2086
invasive.xemphimxxxviet.com:2095
invasive.xemphimxxxviet.com:443
invasive.xemphimxxxviet.com:2053
invasive.xemphimxxxviet.com:2083
invasive.xemphimxxxviet.com:2087
invasive.xemphimxxxviet.com:2096
invasive.xemphimxxxviet.com:8443
stuxnet.xemphimxxxviet.com:80
stuxnet.xemphimxxxviet.com:22
stuxnet.xemphimxxxviet.com:8080
stuxnet.xemphimxxxviet.com:8880
stuxnet.xemphimxxxviet.com:2052
stuxnet.xemphimxxxviet.com:2082
stuxnet.xemphimxxxviet.com:2086
stuxnet.xemphimxxxviet.com:2095
stuxnet.xemphimxxxviet.com:443
stuxnet.xemphimxxxviet.com:2053
stuxnet.xemphimxxxviet.com:2083
stuxnet.xemphimxxxviet.com:2087
stuxnet.xemphimxxxviet.com:2096
stuxnet.xemphimxxxviet.com:8443

Mutex

itPQSCHEWLDz

Attributes

delay
0
install
true
install_file
wdtkrnf.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a952de0a4ffcd41fe0a7ec431d3c7d682104cb7110c39b5e2cbb8a5b947a96de

File Explorer

a952de0a4ffcd41fe0a7ec431d3c7d682104cb7110c39b5e2cbb8a5b947a96de

.exe 45KB

a952de0a4ffcd41fe0a7ec431d3c7d682104cb7110c39b5e2cbb8a5b947a96de

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a952de0a4ffcd41fe0a7ec431d3c7d682104cb7110c39b5e2cbb8a5b947a96de
MD5 d375ad8ae0796c759ce6ab49caf92970
SHA1 2c4ff44ceed917daf1dc310e52388638b0803cb8
SHA512 91b768a784f25d0f4c51f3891a0a99d17cc99f735a4a249d54e3a5224ecf0f08bef8291c68994511a535204b42996aa33076ff729e0eaf42a5b4de7a753430fd
SSDEEP 768:DuAqJT84XVvWUXR1Zmo2qjL9Yq3q3hOPI2zjbQgX3iE/BmEtvAyPvCxBDZcx:DuAqJT84v2AaCq323bXXS6mEKavCPdcx
TLSH
T1D0232A103BE8C12BF2BE4FB89CF26245467AF2633603D6491CC4519A5713BC6DA526FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

a952de0a4ffcd41fe0a7ec431d3c7d682104cb7110c39b5e2cbb8a5b947a96de

mscoree

dotnet