asyncrat | e64a871c119ac3a2326c7c3425f24b043ad4cf3b9a690a46f57e9271a0008a32

Sharing

Copy URL Twitter E-mail

General

Target
e64a871c119ac3a2326c7c3425f24b043ad4cf3b9a690a46f57e9271a0008a32
Size 45KB
Sample260710-s5kcvact2p
SHA256 e64a871c119ac3a2326c7c3425f24b043ad4cf3b9a690a46f57e9271a0008a32
MD5 13b8539566f76d692f6cf93fe4822c75
SHA1 ee4a697b301e0a49e9973dfa9d3ee2b9bccb72c5
SHA512 39b4fc7b111b6dea24a0fef12f97f3705f672ad5845e05ad934d88264d01d78b8bfb675124ed0371b8b40bd2f2b88f495b4d7b05b294dd1d4658c3fc1e9c5856
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFTlsHoPEaMPI1zjbwgX3iVZYhWmzBDZUx:cu7e5TH2A2muuEax13b3XSVZrmdUx
TLSH
T160232A003BE8822BF2BE4F789DF26155467AF6A37603D54A1CC411DB4713FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

x.sexclip.blog:80
x.sexclip.blog:22
x.sexclip.blog:8080
x.sexclip.blog:8880
x.sexclip.blog:2052
x.sexclip.blog:2082
x.sexclip.blog:2086
x.sexclip.blog:2095
x.sexclip.blog:443
x.sexclip.blog:2053
x.sexclip.blog:2083
x.sexclip.blog:2087
x.sexclip.blog:2096
x.sexclip.blog:8443
www.x.sexclip.blog:80
www.x.sexclip.blog:22
www.x.sexclip.blog:8080
www.x.sexclip.blog:8880
www.x.sexclip.blog:2052
www.x.sexclip.blog:2082
www.x.sexclip.blog:2086
www.x.sexclip.blog:2095
www.x.sexclip.blog:443
www.x.sexclip.blog:2053
www.x.sexclip.blog:2083
www.x.sexclip.blog:2087
www.x.sexclip.blog:2096
www.x.sexclip.blog:8443
iloveyou.x.sexclip.blog:80
iloveyou.x.sexclip.blog:22
iloveyou.x.sexclip.blog:8080
iloveyou.x.sexclip.blog:8880
iloveyou.x.sexclip.blog:2052
iloveyou.x.sexclip.blog:2082
iloveyou.x.sexclip.blog:2086
iloveyou.x.sexclip.blog:2095
iloveyou.x.sexclip.blog:443
iloveyou.x.sexclip.blog:2053
iloveyou.x.sexclip.blog:2083
iloveyou.x.sexclip.blog:2087
iloveyou.x.sexclip.blog:2096
iloveyou.x.sexclip.blog:8443
shamoon.x.sexclip.blog:80
shamoon.x.sexclip.blog:22
shamoon.x.sexclip.blog:8080
shamoon.x.sexclip.blog:8880
shamoon.x.sexclip.blog:2052
shamoon.x.sexclip.blog:2082
shamoon.x.sexclip.blog:2086
shamoon.x.sexclip.blog:2095
shamoon.x.sexclip.blog:443
shamoon.x.sexclip.blog:2053
shamoon.x.sexclip.blog:2083
shamoon.x.sexclip.blog:2087
shamoon.x.sexclip.blog:2096
shamoon.x.sexclip.blog:8443

Mutex

qWPcqRC3UqBv

Attributes

delay
0
install
true
install_file
96lza.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e64a871c119ac3a2326c7c3425f24b043ad4cf3b9a690a46f57e9271a0008a32

File Explorer

e64a871c119ac3a2326c7c3425f24b043ad4cf3b9a690a46f57e9271a0008a32

.exe 45KB

e64a871c119ac3a2326c7c3425f24b043ad4cf3b9a690a46f57e9271a0008a32

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e64a871c119ac3a2326c7c3425f24b043ad4cf3b9a690a46f57e9271a0008a32
MD5 13b8539566f76d692f6cf93fe4822c75
SHA1 ee4a697b301e0a49e9973dfa9d3ee2b9bccb72c5
SHA512 39b4fc7b111b6dea24a0fef12f97f3705f672ad5845e05ad934d88264d01d78b8bfb675124ed0371b8b40bd2f2b88f495b4d7b05b294dd1d4658c3fc1e9c5856
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFTlsHoPEaMPI1zjbwgX3iVZYhWmzBDZUx:cu7e5TH2A2muuEax13b3XSVZrmdUx
TLSH
T160232A003BE8822BF2BE4F789DF26155467AF6A37603D54A1CC411DB4713FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e64a871c119ac3a2326c7c3425f24b043ad4cf3b9a690a46f57e9271a0008a32

mscoree

dotnet