asyncrat | 4cf136683f47d1d622db2efa67043df03136dc12ff3c7468acc1c20a4a7bb812

Sharing

Copy URL Twitter E-mail

General

Target
4cf136683f47d1d622db2efa67043df03136dc12ff3c7468acc1c20a4a7bb812
Size 45KB
Sample260711-lcjsaafs2j
SHA256 4cf136683f47d1d622db2efa67043df03136dc12ff3c7468acc1c20a4a7bb812
MD5 5a1f33c99b8b934f695f276ba9e7c5d9
SHA1 df72c4da924986eaba06dd37cbb21f8996bb2fb6
SHA512 f6a0761a8359514c79b4396961b2e10d5aac0261fc017b6d9b5b712090b6e547140652e731a1d38523fce3d41c465167227e291d0ac2020deaacc39ffd5207e2
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYh6R8aI3OPIOzjb7gm3iBPDe0GBDZ0x:8uuSpTgyf2J+FO3O3bEmSwRd0x
TLSH
T1C4231A003BE8812AF2BE4BB89DF26245467EF6633602E5891CC451DB5613FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

bvdhosting.nl:80
bvdhosting.nl:22
bvdhosting.nl:8080
bvdhosting.nl:8880
bvdhosting.nl:2052
bvdhosting.nl:2082
bvdhosting.nl:2086
bvdhosting.nl:2095
bvdhosting.nl:443
bvdhosting.nl:2053
bvdhosting.nl:2083
bvdhosting.nl:2087
bvdhosting.nl:2096
bvdhosting.nl:8443
www.bvdhosting.nl:80
www.bvdhosting.nl:22
www.bvdhosting.nl:8080
www.bvdhosting.nl:8880
www.bvdhosting.nl:2052
www.bvdhosting.nl:2082
www.bvdhosting.nl:2086
www.bvdhosting.nl:2095
www.bvdhosting.nl:443
www.bvdhosting.nl:2053
www.bvdhosting.nl:2083
www.bvdhosting.nl:2087
www.bvdhosting.nl:2096
www.bvdhosting.nl:8443
rat.bvdhosting.nl:80
rat.bvdhosting.nl:22
rat.bvdhosting.nl:8080
rat.bvdhosting.nl:8880
rat.bvdhosting.nl:2052
rat.bvdhosting.nl:2082
rat.bvdhosting.nl:2086
rat.bvdhosting.nl:2095
rat.bvdhosting.nl:443
rat.bvdhosting.nl:2053
rat.bvdhosting.nl:2083
rat.bvdhosting.nl:2087
rat.bvdhosting.nl:2096
rat.bvdhosting.nl:8443
socgholish.bvdhosting.nl:80
socgholish.bvdhosting.nl:22
socgholish.bvdhosting.nl:8080
socgholish.bvdhosting.nl:8880
socgholish.bvdhosting.nl:2052
socgholish.bvdhosting.nl:2082
socgholish.bvdhosting.nl:2086
socgholish.bvdhosting.nl:2095
socgholish.bvdhosting.nl:443
socgholish.bvdhosting.nl:2053
socgholish.bvdhosting.nl:2083
socgholish.bvdhosting.nl:2087
socgholish.bvdhosting.nl:2096
socgholish.bvdhosting.nl:8443
blacklotus.bvdhosting.nl:80
blacklotus.bvdhosting.nl:22
blacklotus.bvdhosting.nl:8080
blacklotus.bvdhosting.nl:8880
blacklotus.bvdhosting.nl:2052
blacklotus.bvdhosting.nl:2082
blacklotus.bvdhosting.nl:2086
blacklotus.bvdhosting.nl:2095
blacklotus.bvdhosting.nl:443
blacklotus.bvdhosting.nl:2053
blacklotus.bvdhosting.nl:2083
blacklotus.bvdhosting.nl:2087
blacklotus.bvdhosting.nl:2096
blacklotus.bvdhosting.nl:8443
industroyer.bvdhosting.nl:80
industroyer.bvdhosting.nl:22
industroyer.bvdhosting.nl:8080
industroyer.bvdhosting.nl:8880
industroyer.bvdhosting.nl:2052
industroyer.bvdhosting.nl:2082
industroyer.bvdhosting.nl:2086
industroyer.bvdhosting.nl:2095
industroyer.bvdhosting.nl:443
industroyer.bvdhosting.nl:2053
industroyer.bvdhosting.nl:2083
industroyer.bvdhosting.nl:2087
industroyer.bvdhosting.nl:2096
industroyer.bvdhosting.nl:8443

Mutex

iYlzFLKZvb98

Attributes

delay
0
install
true
install_file
gezotj.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4cf136683f47d1d622db2efa67043df03136dc12ff3c7468acc1c20a4a7bb812

File Explorer

4cf136683f47d1d622db2efa67043df03136dc12ff3c7468acc1c20a4a7bb812

.exe 45KB

4cf136683f47d1d622db2efa67043df03136dc12ff3c7468acc1c20a4a7bb812

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4cf136683f47d1d622db2efa67043df03136dc12ff3c7468acc1c20a4a7bb812
MD5 5a1f33c99b8b934f695f276ba9e7c5d9
SHA1 df72c4da924986eaba06dd37cbb21f8996bb2fb6
SHA512 f6a0761a8359514c79b4396961b2e10d5aac0261fc017b6d9b5b712090b6e547140652e731a1d38523fce3d41c465167227e291d0ac2020deaacc39ffd5207e2
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYh6R8aI3OPIOzjb7gm3iBPDe0GBDZ0x:8uuSpTgyf2J+FO3O3bEmSwRd0x
TLSH
T1C4231A003BE8812AF2BE4BB89DF26245467EF6633602E5891CC451DB5613FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

4cf136683f47d1d622db2efa67043df03136dc12ff3c7468acc1c20a4a7bb812

mscoree

dotnet