asyncrat | 4eb3dfbd16269cd9a407fd42bcd560a2847f87b7b7929c6d58dad7b8d0409b0e

Sharing

Copy URL Twitter E-mail

General

Target
4eb3dfbd16269cd9a407fd42bcd560a2847f87b7b7929c6d58dad7b8d0409b0e
Size 45KB
Sample260711-nsa67ahv2k
SHA256 4eb3dfbd16269cd9a407fd42bcd560a2847f87b7b7929c6d58dad7b8d0409b0e
MD5 403352473851a49ce34e14c09998824d
SHA1 3a01c24b1eb2e5bebe7c641f6347db95bfa31291
SHA512 ad2df65f0158d574f872cede92cadb06a08b6878ed9d73732a75aef04d3a3d2b8eeb1891bc2eed49e8820f44eb8a1df8d718a070d648c5121965a82066585ff8
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA3BzCQKx7PImbjb4gX3ifdip0Dz3UkBDZcx:UuKWgSJTwRf2no0mPbvXSfsp0fndcx
TLSH
T165231A003BE8822AF2BE4FB86CF26145467AF6637603D54D6CC451D75A23FC6CA426F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

schijndelse.nl:80
schijndelse.nl:22
schijndelse.nl:8080
schijndelse.nl:8880
schijndelse.nl:2052
schijndelse.nl:2082
schijndelse.nl:2086
schijndelse.nl:2095
schijndelse.nl:443
schijndelse.nl:2053
schijndelse.nl:2083
schijndelse.nl:2087
schijndelse.nl:2096
schijndelse.nl:8443
www.schijndelse.nl:80
www.schijndelse.nl:22
www.schijndelse.nl:8080
www.schijndelse.nl:8880
www.schijndelse.nl:2052
www.schijndelse.nl:2082
www.schijndelse.nl:2086
www.schijndelse.nl:2095
www.schijndelse.nl:443
www.schijndelse.nl:2053
www.schijndelse.nl:2083
www.schijndelse.nl:2087
www.schijndelse.nl:2096
www.schijndelse.nl:8443
gootloader.schijndelse.nl:80
gootloader.schijndelse.nl:22
gootloader.schijndelse.nl:8080
gootloader.schijndelse.nl:8880
gootloader.schijndelse.nl:2052
gootloader.schijndelse.nl:2082
gootloader.schijndelse.nl:2086
gootloader.schijndelse.nl:2095
gootloader.schijndelse.nl:443
gootloader.schijndelse.nl:2053
gootloader.schijndelse.nl:2083
gootloader.schijndelse.nl:2087
gootloader.schijndelse.nl:2096
gootloader.schijndelse.nl:8443
melissa.schijndelse.nl:80
melissa.schijndelse.nl:22
melissa.schijndelse.nl:8080
melissa.schijndelse.nl:8880
melissa.schijndelse.nl:2052
melissa.schijndelse.nl:2082
melissa.schijndelse.nl:2086
melissa.schijndelse.nl:2095
melissa.schijndelse.nl:443
melissa.schijndelse.nl:2053
melissa.schijndelse.nl:2083
melissa.schijndelse.nl:2087
melissa.schijndelse.nl:2096
melissa.schijndelse.nl:8443
gh0st.schijndelse.nl:80
gh0st.schijndelse.nl:22
gh0st.schijndelse.nl:8080
gh0st.schijndelse.nl:8880
gh0st.schijndelse.nl:2052
gh0st.schijndelse.nl:2082
gh0st.schijndelse.nl:2086
gh0st.schijndelse.nl:2095
gh0st.schijndelse.nl:443
gh0st.schijndelse.nl:2053
gh0st.schijndelse.nl:2083
gh0st.schijndelse.nl:2087
gh0st.schijndelse.nl:2096
gh0st.schijndelse.nl:8443
darkside.schijndelse.nl:80
darkside.schijndelse.nl:22
darkside.schijndelse.nl:8080
darkside.schijndelse.nl:8880
darkside.schijndelse.nl:2052
darkside.schijndelse.nl:2082
darkside.schijndelse.nl:2086
darkside.schijndelse.nl:2095
darkside.schijndelse.nl:443
darkside.schijndelse.nl:2053
darkside.schijndelse.nl:2083
darkside.schijndelse.nl:2087
darkside.schijndelse.nl:2096
darkside.schijndelse.nl:8443

Mutex

HgoIyRygra6h

Attributes

delay
0
install
true
install_file
gkjj5r5d.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4eb3dfbd16269cd9a407fd42bcd560a2847f87b7b7929c6d58dad7b8d0409b0e

File Explorer

4eb3dfbd16269cd9a407fd42bcd560a2847f87b7b7929c6d58dad7b8d0409b0e

.exe 45KB

4eb3dfbd16269cd9a407fd42bcd560a2847f87b7b7929c6d58dad7b8d0409b0e

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4eb3dfbd16269cd9a407fd42bcd560a2847f87b7b7929c6d58dad7b8d0409b0e
MD5 403352473851a49ce34e14c09998824d
SHA1 3a01c24b1eb2e5bebe7c641f6347db95bfa31291
SHA512 ad2df65f0158d574f872cede92cadb06a08b6878ed9d73732a75aef04d3a3d2b8eeb1891bc2eed49e8820f44eb8a1df8d718a070d648c5121965a82066585ff8
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA3BzCQKx7PImbjb4gX3ifdip0Dz3UkBDZcx:UuKWgSJTwRf2no0mPbvXSfsp0fndcx
TLSH
T165231A003BE8822AF2BE4FB86CF26145467AF6637603D54D6CC451D75A23FC6CA426F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

4eb3dfbd16269cd9a407fd42bcd560a2847f87b7b7929c6d58dad7b8d0409b0e

mscoree

dotnet