asyncrat | c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08

Sharing

Copy URL Twitter E-mail

General

Target
c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08
Size 45KB
Sample260710-ndj6jsbs5v
SHA256 c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08
MD5 4384f789b45f93d1a9c0da55d90eb7e6
SHA1 a50915482339136cab180d69028d2264f9a627df
SHA512 a451280973bdb1ff06a26105195974e8f950732e72fb36cc306ac164324c14c4e01a725af7bbd5ba5c7005027c6a7f462ec8e706e2271f2dff5ebb8a40e5fb4b
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFdm//GgrOPIm8zjbkgX3iGV1ltyHUuLN1jBDZEx:MuLAZTnbg2umHb3Z3brXS6N6lLvldEx
TLSH
T18B232B003BE8822BF2BE4F78ACF26145857AF2636603D54E1CC451D75A13FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

damsex.blog:80
damsex.blog:22
damsex.blog:8080
damsex.blog:8880
damsex.blog:2052
damsex.blog:2082
damsex.blog:2086
damsex.blog:2095
damsex.blog:443
damsex.blog:2053
damsex.blog:2083
damsex.blog:2087
damsex.blog:2096
damsex.blog:8443
www.damsex.blog:80
www.damsex.blog:22
www.damsex.blog:8080
www.damsex.blog:8880
www.damsex.blog:2052
www.damsex.blog:2082
www.damsex.blog:2086
www.damsex.blog:2095
www.damsex.blog:443
www.damsex.blog:2053
www.damsex.blog:2083
www.damsex.blog:2087
www.damsex.blog:2096
www.damsex.blog:8443
remote.damsex.blog:80
remote.damsex.blog:22
remote.damsex.blog:8080
remote.damsex.blog:8880
remote.damsex.blog:2052
remote.damsex.blog:2082
remote.damsex.blog:2086
remote.damsex.blog:2095
remote.damsex.blog:443
remote.damsex.blog:2053
remote.damsex.blog:2083
remote.damsex.blog:2087
remote.damsex.blog:2096
remote.damsex.blog:8443
ryuk.damsex.blog:80
ryuk.damsex.blog:22
ryuk.damsex.blog:8080
ryuk.damsex.blog:8880
ryuk.damsex.blog:2052
ryuk.damsex.blog:2082
ryuk.damsex.blog:2086
ryuk.damsex.blog:2095
ryuk.damsex.blog:443
ryuk.damsex.blog:2053
ryuk.damsex.blog:2083
ryuk.damsex.blog:2087
ryuk.damsex.blog:2096
ryuk.damsex.blog:8443
hacker.damsex.blog:80
hacker.damsex.blog:22
hacker.damsex.blog:8080
hacker.damsex.blog:8880
hacker.damsex.blog:2052
hacker.damsex.blog:2082
hacker.damsex.blog:2086
hacker.damsex.blog:2095
hacker.damsex.blog:443
hacker.damsex.blog:2053
hacker.damsex.blog:2083
hacker.damsex.blog:2087
hacker.damsex.blog:2096
hacker.damsex.blog:8443
iloveyou.damsex.blog:80
iloveyou.damsex.blog:22
iloveyou.damsex.blog:8080
iloveyou.damsex.blog:8880
iloveyou.damsex.blog:2052
iloveyou.damsex.blog:2082
iloveyou.damsex.blog:2086
iloveyou.damsex.blog:2095
iloveyou.damsex.blog:443
iloveyou.damsex.blog:2053
iloveyou.damsex.blog:2083
iloveyou.damsex.blog:2087
iloveyou.damsex.blog:2096
iloveyou.damsex.blog:8443

Mutex

ccfuftyJLPkl

Attributes

delay
0
install
true
install_file
92j9f.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08

File Explorer

c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08

.exe 45KB

c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08
MD5 4384f789b45f93d1a9c0da55d90eb7e6
SHA1 a50915482339136cab180d69028d2264f9a627df
SHA512 a451280973bdb1ff06a26105195974e8f950732e72fb36cc306ac164324c14c4e01a725af7bbd5ba5c7005027c6a7f462ec8e706e2271f2dff5ebb8a40e5fb4b
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFdm//GgrOPIm8zjbkgX3iGV1ltyHUuLN1jBDZEx:MuLAZTnbg2umHb3Z3brXS6N6lLvldEx
TLSH
T18B232B003BE8822BF2BE4F78ACF26145857AF2636603D54E1CC451D75A13FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c50ff36bddf3fa20313c23d8042e1d72c323d6046f795a1c54b44ec583dedf08

mscoree

dotnet