asyncrat | cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f

Sharing

Copy URL Twitter E-mail

General

Target
cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f
Size 45KB
Sample260711-llb4sshv4w
SHA256 cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f
MD5 2d2bf0f2e97f9521ba6a392bae4c6209
SHA1 c7eb91e19272545d4da85686104f1a0a311d022c
SHA512 55277fc56049987cf85a5a34d1d84d930b6919212158911d35433c2595adefd32a4951d48694c52f120cd5790e30e97da88e4c8eaebfc6a5c4b8a2744f346daf
SSDEEP 768:HuCIJTQc5fVWUhxlDmo2qrm0UwPOlehAPITpzjb3gX3i7hE6m4jQ851BDZYx:HuCIJTQmX250/OghlTp3bQXS7+L3WdYx
TLSH
T110233A003BE8812BF2BE4F78A9F26145867AF6633603D6491CC451DB5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexviet.com:80
mephimsexviet.com:22
mephimsexviet.com:8080
mephimsexviet.com:8880
mephimsexviet.com:2052
mephimsexviet.com:2082
mephimsexviet.com:2086
mephimsexviet.com:2095
mephimsexviet.com:443
mephimsexviet.com:2053
mephimsexviet.com:2083
mephimsexviet.com:2087
mephimsexviet.com:2096
mephimsexviet.com:8443
www.mephimsexviet.com:80
www.mephimsexviet.com:22
www.mephimsexviet.com:8080
www.mephimsexviet.com:8880
www.mephimsexviet.com:2052
www.mephimsexviet.com:2082
www.mephimsexviet.com:2086
www.mephimsexviet.com:2095
www.mephimsexviet.com:443
www.mephimsexviet.com:2053
www.mephimsexviet.com:2083
www.mephimsexviet.com:2087
www.mephimsexviet.com:2096
www.mephimsexviet.com:8443
malware.mephimsexviet.com:80
malware.mephimsexviet.com:22
malware.mephimsexviet.com:8080
malware.mephimsexviet.com:8880
malware.mephimsexviet.com:2052
malware.mephimsexviet.com:2082
malware.mephimsexviet.com:2086
malware.mephimsexviet.com:2095
malware.mephimsexviet.com:443
malware.mephimsexviet.com:2053
malware.mephimsexviet.com:2083
malware.mephimsexviet.com:2087
malware.mephimsexviet.com:2096
malware.mephimsexviet.com:8443
codered.mephimsexviet.com:80
codered.mephimsexviet.com:22
codered.mephimsexviet.com:8080
codered.mephimsexviet.com:8880
codered.mephimsexviet.com:2052
codered.mephimsexviet.com:2082
codered.mephimsexviet.com:2086
codered.mephimsexviet.com:2095
codered.mephimsexviet.com:443
codered.mephimsexviet.com:2053
codered.mephimsexviet.com:2083
codered.mephimsexviet.com:2087
codered.mephimsexviet.com:2096
codered.mephimsexviet.com:8443
qakbot.mephimsexviet.com:80
qakbot.mephimsexviet.com:22
qakbot.mephimsexviet.com:8080
qakbot.mephimsexviet.com:8880
qakbot.mephimsexviet.com:2052
qakbot.mephimsexviet.com:2082
qakbot.mephimsexviet.com:2086
qakbot.mephimsexviet.com:2095
qakbot.mephimsexviet.com:443
qakbot.mephimsexviet.com:2053
qakbot.mephimsexviet.com:2083
qakbot.mephimsexviet.com:2087
qakbot.mephimsexviet.com:2096
qakbot.mephimsexviet.com:8443
blacklotus.mephimsexviet.com:80
blacklotus.mephimsexviet.com:22
blacklotus.mephimsexviet.com:8080
blacklotus.mephimsexviet.com:8880
blacklotus.mephimsexviet.com:2052
blacklotus.mephimsexviet.com:2082
blacklotus.mephimsexviet.com:2086
blacklotus.mephimsexviet.com:2095
blacklotus.mephimsexviet.com:443
blacklotus.mephimsexviet.com:2053
blacklotus.mephimsexviet.com:2083
blacklotus.mephimsexviet.com:2087
blacklotus.mephimsexviet.com:2096
blacklotus.mephimsexviet.com:8443

Mutex

RcQaXyEBE2Xo

Attributes

delay
0
install
true
install_file
kffe9mqv.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f

File Explorer

cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f

.exe 45KB

cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f
MD5 2d2bf0f2e97f9521ba6a392bae4c6209
SHA1 c7eb91e19272545d4da85686104f1a0a311d022c
SHA512 55277fc56049987cf85a5a34d1d84d930b6919212158911d35433c2595adefd32a4951d48694c52f120cd5790e30e97da88e4c8eaebfc6a5c4b8a2744f346daf
SSDEEP 768:HuCIJTQc5fVWUhxlDmo2qrm0UwPOlehAPITpzjb3gX3i7hE6m4jQ851BDZYx:HuCIJTQmX250/OghlTp3bQXS7+L3WdYx
TLSH
T110233A003BE8812BF2BE4F78A9F26145867AF6633603D6491CC451DB5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

cb58f78a81b5f35ef436883482d7897a3bf41395ce9cdc82c764975056a6e84f

mscoree

dotnet