asyncrat | deafb3e6f4dd6c55a690beaa6c3b92ba7382f340c1cacb285c4830e87054db84

Sharing

Copy URL Twitter E-mail

General

Target
deafb3e6f4dd6c55a690beaa6c3b92ba7382f340c1cacb285c4830e87054db84
Size 45KB
Sample260706-exynlshx21
SHA256 deafb3e6f4dd6c55a690beaa6c3b92ba7382f340c1cacb285c4830e87054db84
MD5 9d68f1582e92d12c17315a4525ca02b7
SHA1 a6937566f46e2e192639a0c03741ce8d54a577cf
SHA512 4ce60ccf4886d4229278f81de6d3737c45fc6514a7a9f9d226184d35eb9ebcad1637b3b91ee672ae8561248c181f7952a2e34846c6b6912f8d32f723615ac25b
SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFOUJ+XOoJ9hU/NPIEfzjbNgX3iCseX0hAdfXBDZbx:4uLZZTUTn2TU0eI9hyqEf3baXSC35dbx
TLSH
T199232B003BE8812BF2BF5F7859F26145867AF2633603D58E1CC4519B5713FC59642AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexgaga.com:80
sexgaga.com:22
sexgaga.com:8080
sexgaga.com:8880
sexgaga.com:2052
sexgaga.com:2082
sexgaga.com:2086
sexgaga.com:2095
sexgaga.com:443
sexgaga.com:2053
sexgaga.com:2083
sexgaga.com:2087
sexgaga.com:2096
sexgaga.com:8443
www.sexgaga.com:80
www.sexgaga.com:22
www.sexgaga.com:8080
www.sexgaga.com:8880
www.sexgaga.com:2052
www.sexgaga.com:2082
www.sexgaga.com:2086
www.sexgaga.com:2095
www.sexgaga.com:443
www.sexgaga.com:2053
www.sexgaga.com:2083
www.sexgaga.com:2087
www.sexgaga.com:2096
www.sexgaga.com:8443
remote.sexgaga.com:80
remote.sexgaga.com:22
remote.sexgaga.com:8080
remote.sexgaga.com:8880
remote.sexgaga.com:2052
remote.sexgaga.com:2082
remote.sexgaga.com:2086
remote.sexgaga.com:2095
remote.sexgaga.com:443
remote.sexgaga.com:2053
remote.sexgaga.com:2083
remote.sexgaga.com:2087
remote.sexgaga.com:2096
remote.sexgaga.com:8443
clop.sexgaga.com:80
clop.sexgaga.com:22
clop.sexgaga.com:8080
clop.sexgaga.com:8880
clop.sexgaga.com:2052
clop.sexgaga.com:2082
clop.sexgaga.com:2086
clop.sexgaga.com:2095
clop.sexgaga.com:443
clop.sexgaga.com:2053
clop.sexgaga.com:2083
clop.sexgaga.com:2087
clop.sexgaga.com:2096
clop.sexgaga.com:8443

Mutex

FAeB33rXKC4D

Attributes

delay
0
install
true
install_file
vq1qv.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
deafb3e6f4dd6c55a690beaa6c3b92ba7382f340c1cacb285c4830e87054db84

File Explorer

deafb3e6f4dd6c55a690beaa6c3b92ba7382f340c1cacb285c4830e87054db84

.exe 45KB

deafb3e6f4dd6c55a690beaa6c3b92ba7382f340c1cacb285c4830e87054db84

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 deafb3e6f4dd6c55a690beaa6c3b92ba7382f340c1cacb285c4830e87054db84
MD5 9d68f1582e92d12c17315a4525ca02b7
SHA1 a6937566f46e2e192639a0c03741ce8d54a577cf
SHA512 4ce60ccf4886d4229278f81de6d3737c45fc6514a7a9f9d226184d35eb9ebcad1637b3b91ee672ae8561248c181f7952a2e34846c6b6912f8d32f723615ac25b
SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFOUJ+XOoJ9hU/NPIEfzjbNgX3iCseX0hAdfXBDZbx:4uLZZTUTn2TU0eI9hyqEf3baXSC35dbx
TLSH
T199232B003BE8812BF2BF5F7859F26145867AF2633603D58E1CC4519B5713FC59642AEE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

deafb3e6f4dd6c55a690beaa6c3b92ba7382f340c1cacb285c4830e87054db84

mscoree

dotnet