asyncrat | 9252b6ae360e242003b203c107e7de4331389c3f4ad7bf71a077e96df94340ed

Sharing

Copy URL Twitter E-mail

General

Target
9252b6ae360e242003b203c107e7de4331389c3f4ad7bf71a077e96df94340ed
Size 45KB
Sample260710-2d3vjscy6m
SHA256 9252b6ae360e242003b203c107e7de4331389c3f4ad7bf71a077e96df94340ed
MD5 6d7fb972ba611186395311c7e63dc706
SHA1 0bbfd6939e8f028936900343f4485b0693665d72
SHA512 949625f6113dbddd82b409ba76da0fa0b1500f2113d0452336f2d7cd4cf4644407803de73ee9bcc477736e22446d04253cb3086726af910f00045f04705aa536
SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlRhk6K7OOPIzzjb6g13ijRMOrTi7BDZMx:wuDWZTpMZSB2I6VO3z3bt1SZXQdMx
TLSH
T169233B003BE8822BF2BE4F789CF26145467AF6B37603D5491CC4519B5A13FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phaixemsex.me:80
phaixemsex.me:22
phaixemsex.me:8080
phaixemsex.me:8880
phaixemsex.me:2052
phaixemsex.me:2082
phaixemsex.me:2086
phaixemsex.me:2095
phaixemsex.me:443
phaixemsex.me:2053
phaixemsex.me:2083
phaixemsex.me:2087
phaixemsex.me:2096
phaixemsex.me:8443
www.phaixemsex.me:80
www.phaixemsex.me:22
www.phaixemsex.me:8080
www.phaixemsex.me:8880
www.phaixemsex.me:2052
www.phaixemsex.me:2082
www.phaixemsex.me:2086
www.phaixemsex.me:2095
www.phaixemsex.me:443
www.phaixemsex.me:2053
www.phaixemsex.me:2083
www.phaixemsex.me:2087
www.phaixemsex.me:2096
www.phaixemsex.me:8443
connect.phaixemsex.me:80
connect.phaixemsex.me:22
connect.phaixemsex.me:8080
connect.phaixemsex.me:8880
connect.phaixemsex.me:2052
connect.phaixemsex.me:2082
connect.phaixemsex.me:2086
connect.phaixemsex.me:2095
connect.phaixemsex.me:443
connect.phaixemsex.me:2053
connect.phaixemsex.me:2083
connect.phaixemsex.me:2087
connect.phaixemsex.me:2096
connect.phaixemsex.me:8443
revil.phaixemsex.me:80
revil.phaixemsex.me:22
revil.phaixemsex.me:8080
revil.phaixemsex.me:8880
revil.phaixemsex.me:2052
revil.phaixemsex.me:2082
revil.phaixemsex.me:2086
revil.phaixemsex.me:2095
revil.phaixemsex.me:443
revil.phaixemsex.me:2053
revil.phaixemsex.me:2083
revil.phaixemsex.me:2087
revil.phaixemsex.me:2096
revil.phaixemsex.me:8443

Mutex

ji0lFC2cdGa5

Attributes

delay
0
install
true
install_file
no07h.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9252b6ae360e242003b203c107e7de4331389c3f4ad7bf71a077e96df94340ed

File Explorer

9252b6ae360e242003b203c107e7de4331389c3f4ad7bf71a077e96df94340ed

.exe 45KB

9252b6ae360e242003b203c107e7de4331389c3f4ad7bf71a077e96df94340ed

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9252b6ae360e242003b203c107e7de4331389c3f4ad7bf71a077e96df94340ed
MD5 6d7fb972ba611186395311c7e63dc706
SHA1 0bbfd6939e8f028936900343f4485b0693665d72
SHA512 949625f6113dbddd82b409ba76da0fa0b1500f2113d0452336f2d7cd4cf4644407803de73ee9bcc477736e22446d04253cb3086726af910f00045f04705aa536
SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlRhk6K7OOPIzzjb6g13ijRMOrTi7BDZMx:wuDWZTpMZSB2I6VO3z3bt1SZXQdMx
TLSH
T169233B003BE8822BF2BE4F789CF26145467AF6B37603D5491CC4519B5A13FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

9252b6ae360e242003b203c107e7de4331389c3f4ad7bf71a077e96df94340ed

mscoree

dotnet