asyncrat | 2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046

Sharing

Copy URL Twitter E-mail

General

Target
2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046
Size 45KB
Sample260706-fym4yah16w
SHA256 2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046
MD5 01d851c9865c1466620d614b23d89ec7
SHA1 e5f736ca4b55c3ba29c01e48cbc272d1d29d231f
SHA512 795e7fe5cc7bd5bc6d08bf5fb5b00ae6c5d08872c8a914aa6f006fa84513b11465a580cd6e385dc6212be9c65c4697655b543e8ae9e94de4775d8438af232de3
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAT0ewUkA1MiZPI7zjbag/3iK57TVwIyHPD5aBDZUx:cuqNJTLr62nwvDiW73bN/SK5PVwIyvDN
TLSH
T10E231B0037E8812BF2BE4F78A8F26245867AF6676A03D5491CC451DB5713FC6CA43AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

transferstropicalsunbay.com:80
transferstropicalsunbay.com:22
transferstropicalsunbay.com:8080
transferstropicalsunbay.com:8880
transferstropicalsunbay.com:2052
transferstropicalsunbay.com:2082
transferstropicalsunbay.com:2086
transferstropicalsunbay.com:2095
transferstropicalsunbay.com:443
transferstropicalsunbay.com:2053
transferstropicalsunbay.com:2083
transferstropicalsunbay.com:2087
transferstropicalsunbay.com:2096
transferstropicalsunbay.com:8443
www.transferstropicalsunbay.com:80
www.transferstropicalsunbay.com:22
www.transferstropicalsunbay.com:8080
www.transferstropicalsunbay.com:8880
www.transferstropicalsunbay.com:2052
www.transferstropicalsunbay.com:2082
www.transferstropicalsunbay.com:2086
www.transferstropicalsunbay.com:2095
www.transferstropicalsunbay.com:443
www.transferstropicalsunbay.com:2053
www.transferstropicalsunbay.com:2083
www.transferstropicalsunbay.com:2087
www.transferstropicalsunbay.com:2096
www.transferstropicalsunbay.com:8443
hack.transferstropicalsunbay.com:80
hack.transferstropicalsunbay.com:22
hack.transferstropicalsunbay.com:8080
hack.transferstropicalsunbay.com:8880
hack.transferstropicalsunbay.com:2052
hack.transferstropicalsunbay.com:2082
hack.transferstropicalsunbay.com:2086
hack.transferstropicalsunbay.com:2095
hack.transferstropicalsunbay.com:443
hack.transferstropicalsunbay.com:2053
hack.transferstropicalsunbay.com:2083
hack.transferstropicalsunbay.com:2087
hack.transferstropicalsunbay.com:2096
hack.transferstropicalsunbay.com:8443
shamoon.transferstropicalsunbay.com:80
shamoon.transferstropicalsunbay.com:22
shamoon.transferstropicalsunbay.com:8080
shamoon.transferstropicalsunbay.com:8880
shamoon.transferstropicalsunbay.com:2052
shamoon.transferstropicalsunbay.com:2082
shamoon.transferstropicalsunbay.com:2086
shamoon.transferstropicalsunbay.com:2095
shamoon.transferstropicalsunbay.com:443
shamoon.transferstropicalsunbay.com:2053
shamoon.transferstropicalsunbay.com:2083
shamoon.transferstropicalsunbay.com:2087
shamoon.transferstropicalsunbay.com:2096
shamoon.transferstropicalsunbay.com:8443

Mutex

zoD9o0DyhyEo

Attributes

delay
0
install
true
install_file
3yjh.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046

File Explorer

2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046

.exe 45KB

2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046
MD5 01d851c9865c1466620d614b23d89ec7
SHA1 e5f736ca4b55c3ba29c01e48cbc272d1d29d231f
SHA512 795e7fe5cc7bd5bc6d08bf5fb5b00ae6c5d08872c8a914aa6f006fa84513b11465a580cd6e385dc6212be9c65c4697655b543e8ae9e94de4775d8438af232de3
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAT0ewUkA1MiZPI7zjbag/3iK57TVwIyHPD5aBDZUx:cuqNJTLr62nwvDiW73bN/SK5PVwIyvDN
TLSH
T10E231B0037E8812BF2BE4F78A8F26245867AF6676A03D5491CC451DB5713FC6CA43AED
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

2f4b1f7a6e0bc327c40b9a7b0d9cb67ccadc01ed8531cd4a44604a368cd5a046

mscoree

dotnet