asyncrat | 03f115b79085cca9624cb009039bcfbacb593026d38e6463a33ed971cbc32582

Sharing

Copy URL Twitter E-mail

General

Target
03f115b79085cca9624cb009039bcfbacb593026d38e6463a33ed971cbc32582
Size 45KB
Sample260710-lwanqag14j
SHA256 03f115b79085cca9624cb009039bcfbacb593026d38e6463a33ed971cbc32582
MD5 3126c0e0c6e03a6e80c7c7780bb2fd62
SHA1 0fe94833010d66f9c780c7f9c084066fa87e7b00
SHA512 4b22bb570c35270585cc13e5cb8f8b7609feb21e8511e5066b4c2768557806e5dab24923dde48f82bfb8e9be7f9338466da664798f16f098e8d5e0373726a6db
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFb3xq6YFoOPIUzjbvgm3iop0GfN0Hqbh+xSJWBDZUx:cu7e5TH2A2ukxo3U3bYmSoxfN0HO+EJz
TLSH
T13A232B003BE8812BF2BE5F749CF26145867AF5A33603D54A1CC452DB5623FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

gestofacil.com:80
gestofacil.com:22
gestofacil.com:8080
gestofacil.com:8880
gestofacil.com:2052
gestofacil.com:2082
gestofacil.com:2086
gestofacil.com:2095
gestofacil.com:443
gestofacil.com:2053
gestofacil.com:2083
gestofacil.com:2087
gestofacil.com:2096
gestofacil.com:8443
www.gestofacil.com:80
www.gestofacil.com:22
www.gestofacil.com:8080
www.gestofacil.com:8880
www.gestofacil.com:2052
www.gestofacil.com:2082
www.gestofacil.com:2086
www.gestofacil.com:2095
www.gestofacil.com:443
www.gestofacil.com:2053
www.gestofacil.com:2083
www.gestofacil.com:2087
www.gestofacil.com:2096
www.gestofacil.com:8443
socgholish.gestofacil.com:80
socgholish.gestofacil.com:22
socgholish.gestofacil.com:8080
socgholish.gestofacil.com:8880
socgholish.gestofacil.com:2052
socgholish.gestofacil.com:2082
socgholish.gestofacil.com:2086
socgholish.gestofacil.com:2095
socgholish.gestofacil.com:443
socgholish.gestofacil.com:2053
socgholish.gestofacil.com:2083
socgholish.gestofacil.com:2087
socgholish.gestofacil.com:2096
socgholish.gestofacil.com:8443
agenttesla.gestofacil.com:80
agenttesla.gestofacil.com:22
agenttesla.gestofacil.com:8080
agenttesla.gestofacil.com:8880
agenttesla.gestofacil.com:2052
agenttesla.gestofacil.com:2082
agenttesla.gestofacil.com:2086
agenttesla.gestofacil.com:2095
agenttesla.gestofacil.com:443
agenttesla.gestofacil.com:2053
agenttesla.gestofacil.com:2083
agenttesla.gestofacil.com:2087
agenttesla.gestofacil.com:2096
agenttesla.gestofacil.com:8443

Mutex

nh8U5EP2SDTC

Attributes

delay
0
install
true
install_file
hs4fl.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03f115b79085cca9624cb009039bcfbacb593026d38e6463a33ed971cbc32582

File Explorer

03f115b79085cca9624cb009039bcfbacb593026d38e6463a33ed971cbc32582

.exe 45KB

03f115b79085cca9624cb009039bcfbacb593026d38e6463a33ed971cbc32582

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 03f115b79085cca9624cb009039bcfbacb593026d38e6463a33ed971cbc32582
MD5 3126c0e0c6e03a6e80c7c7780bb2fd62
SHA1 0fe94833010d66f9c780c7f9c084066fa87e7b00
SHA512 4b22bb570c35270585cc13e5cb8f8b7609feb21e8511e5066b4c2768557806e5dab24923dde48f82bfb8e9be7f9338466da664798f16f098e8d5e0373726a6db
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFb3xq6YFoOPIUzjbvgm3iop0GfN0Hqbh+xSJWBDZUx:cu7e5TH2A2ukxo3U3bYmSoxfN0HO+EJz
TLSH
T13A232B003BE8812BF2BE5F749CF26145867AF5A33603D54A1CC452DB5623FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

03f115b79085cca9624cb009039bcfbacb593026d38e6463a33ed971cbc32582

mscoree

dotnet