asyncrat | 1e1b462e53bd5d65f582297290a7e5d616f0cbefa1767e0baefeb7167241369a

Sharing

Copy URL Twitter E-mail

General

Target
1e1b462e53bd5d65f582297290a7e5d616f0cbefa1767e0baefeb7167241369a
Size 45KB
Sample260707-pt8drah14x
SHA256 1e1b462e53bd5d65f582297290a7e5d616f0cbefa1767e0baefeb7167241369a
MD5 f6e4807512a6440e4d870d2f6d0a1dd9
SHA1 316490aaeca6f66e205ddd468110ba13a75ca9ad
SHA512 fc182d2ad896f4dcb0a0c4cff086d0537d6c84b6f8786ed413373d00eb793d6d7ca28259aa853cf05a18dc96e35af491e2187becb03e2114842dfd8e80771c48
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFKNd3u40cMOPI08zjbBgX+iYTESkUxhIcGoVZBDZUx:cu7e5TH2A2R8+M3083buXHYoSVoboVH0
TLSH
T154231A003BE8812BF2BE4F7899F26145867AF2633603D54A1CC451DB5713FC6DA526FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vlxxzz.net:80
vlxxzz.net:22
vlxxzz.net:8080
vlxxzz.net:8880
vlxxzz.net:2052
vlxxzz.net:2082
vlxxzz.net:2086
vlxxzz.net:2095
vlxxzz.net:443
vlxxzz.net:2053
vlxxzz.net:2083
vlxxzz.net:2087
vlxxzz.net:2096
vlxxzz.net:8443
www.vlxxzz.net:80
www.vlxxzz.net:22
www.vlxxzz.net:8080
www.vlxxzz.net:8880
www.vlxxzz.net:2052
www.vlxxzz.net:2082
www.vlxxzz.net:2086
www.vlxxzz.net:2095
www.vlxxzz.net:443
www.vlxxzz.net:2053
www.vlxxzz.net:2083
www.vlxxzz.net:2087
www.vlxxzz.net:2096
www.vlxxzz.net:8443
malware.vlxxzz.net:80
malware.vlxxzz.net:22
malware.vlxxzz.net:8080
malware.vlxxzz.net:8880
malware.vlxxzz.net:2052
malware.vlxxzz.net:2082
malware.vlxxzz.net:2086
malware.vlxxzz.net:2095
malware.vlxxzz.net:443
malware.vlxxzz.net:2053
malware.vlxxzz.net:2083
malware.vlxxzz.net:2087
malware.vlxxzz.net:2096
malware.vlxxzz.net:8443
hacker.vlxxzz.net:80
hacker.vlxxzz.net:22
hacker.vlxxzz.net:8080
hacker.vlxxzz.net:8880
hacker.vlxxzz.net:2052
hacker.vlxxzz.net:2082
hacker.vlxxzz.net:2086
hacker.vlxxzz.net:2095
hacker.vlxxzz.net:443
hacker.vlxxzz.net:2053
hacker.vlxxzz.net:2083
hacker.vlxxzz.net:2087
hacker.vlxxzz.net:2096
hacker.vlxxzz.net:8443
remote.vlxxzz.net:80
remote.vlxxzz.net:22
remote.vlxxzz.net:8080
remote.vlxxzz.net:8880
remote.vlxxzz.net:2052
remote.vlxxzz.net:2082
remote.vlxxzz.net:2086
remote.vlxxzz.net:2095
remote.vlxxzz.net:443
remote.vlxxzz.net:2053
remote.vlxxzz.net:2083
remote.vlxxzz.net:2087
remote.vlxxzz.net:2096
remote.vlxxzz.net:8443

Mutex

oA2yVuuHDWly

Attributes

delay
0
install
true
install_file
37wgq.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1e1b462e53bd5d65f582297290a7e5d616f0cbefa1767e0baefeb7167241369a

File Explorer

1e1b462e53bd5d65f582297290a7e5d616f0cbefa1767e0baefeb7167241369a

.exe 45KB

1e1b462e53bd5d65f582297290a7e5d616f0cbefa1767e0baefeb7167241369a

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1e1b462e53bd5d65f582297290a7e5d616f0cbefa1767e0baefeb7167241369a
MD5 f6e4807512a6440e4d870d2f6d0a1dd9
SHA1 316490aaeca6f66e205ddd468110ba13a75ca9ad
SHA512 fc182d2ad896f4dcb0a0c4cff086d0537d6c84b6f8786ed413373d00eb793d6d7ca28259aa853cf05a18dc96e35af491e2187becb03e2114842dfd8e80771c48
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFKNd3u40cMOPI08zjbBgX+iYTESkUxhIcGoVZBDZUx:cu7e5TH2A2R8+M3083buXHYoSVoboVH0
TLSH
T154231A003BE8812BF2BE4F7899F26145867AF2633603D54A1CC451DB5713FC6DA526FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

1e1b462e53bd5d65f582297290a7e5d616f0cbefa1767e0baefeb7167241369a

mscoree

dotnet