asyncrat | 1fc6e513393039b2feb979905d8f972923887f47a8a6b846efd46ad782811fb7

Sharing

Copy URL Twitter E-mail

General

Target
1fc6e513393039b2feb979905d8f972923887f47a8a6b846efd46ad782811fb7
Size 45KB
Sample260712-c475hset5s
SHA256 1fc6e513393039b2feb979905d8f972923887f47a8a6b846efd46ad782811fb7
MD5 accd613db0e63d5e63dfe6eb2b3f713f
SHA1 bf3c6ff668d5fc2d23d69d0618c75726eedd317c
SHA512 5364b6551b5a450228e1dd1dc9daee90a1fa9aae69e3f196528447a3992096bb0aa710f24797dc78ccdd82923c2c9546377997b27bab0794f6640af066492bbe
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV7lH440WMOPI0kzjbWgXdiT+So9nHrUBDZUx:cu7e5TH2A2QqUM30k3bJXsT+t9HOdUx
TLSH
T1CD231A003BE88127F2BE4F78ADF26145867AF5636603D54E1CC452DB5A13FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

bunji-adult.com:80
bunji-adult.com:22
bunji-adult.com:8080
bunji-adult.com:8880
bunji-adult.com:2052
bunji-adult.com:2082
bunji-adult.com:2086
bunji-adult.com:2095
bunji-adult.com:443
bunji-adult.com:2053
bunji-adult.com:2083
bunji-adult.com:2087
bunji-adult.com:2096
bunji-adult.com:8443
www.bunji-adult.com:80
www.bunji-adult.com:22
www.bunji-adult.com:8080
www.bunji-adult.com:8880
www.bunji-adult.com:2052
www.bunji-adult.com:2082
www.bunji-adult.com:2086
www.bunji-adult.com:2095
www.bunji-adult.com:443
www.bunji-adult.com:2053
www.bunji-adult.com:2083
www.bunji-adult.com:2087
www.bunji-adult.com:2096
www.bunji-adult.com:8443
remcos.bunji-adult.com:80
remcos.bunji-adult.com:22
remcos.bunji-adult.com:8080
remcos.bunji-adult.com:8880
remcos.bunji-adult.com:2052
remcos.bunji-adult.com:2082
remcos.bunji-adult.com:2086
remcos.bunji-adult.com:2095
remcos.bunji-adult.com:443
remcos.bunji-adult.com:2053
remcos.bunji-adult.com:2083
remcos.bunji-adult.com:2087
remcos.bunji-adult.com:2096
remcos.bunji-adult.com:8443
mydoom.bunji-adult.com:80
mydoom.bunji-adult.com:22
mydoom.bunji-adult.com:8080
mydoom.bunji-adult.com:8880
mydoom.bunji-adult.com:2052
mydoom.bunji-adult.com:2082
mydoom.bunji-adult.com:2086
mydoom.bunji-adult.com:2095
mydoom.bunji-adult.com:443
mydoom.bunji-adult.com:2053
mydoom.bunji-adult.com:2083
mydoom.bunji-adult.com:2087
mydoom.bunji-adult.com:2096
mydoom.bunji-adult.com:8443

Mutex

aMStAdYoKctm

Attributes

delay
0
install
true
install_file
kmkqn.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1fc6e513393039b2feb979905d8f972923887f47a8a6b846efd46ad782811fb7

File Explorer

1fc6e513393039b2feb979905d8f972923887f47a8a6b846efd46ad782811fb7

.exe 45KB

1fc6e513393039b2feb979905d8f972923887f47a8a6b846efd46ad782811fb7

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1fc6e513393039b2feb979905d8f972923887f47a8a6b846efd46ad782811fb7
MD5 accd613db0e63d5e63dfe6eb2b3f713f
SHA1 bf3c6ff668d5fc2d23d69d0618c75726eedd317c
SHA512 5364b6551b5a450228e1dd1dc9daee90a1fa9aae69e3f196528447a3992096bb0aa710f24797dc78ccdd82923c2c9546377997b27bab0794f6640af066492bbe
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV7lH440WMOPI0kzjbWgXdiT+So9nHrUBDZUx:cu7e5TH2A2QqUM30k3bJXsT+t9HOdUx
TLSH
T1CD231A003BE88127F2BE4F78ADF26145867AF5636603D54E1CC452DB5A13FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

1fc6e513393039b2feb979905d8f972923887f47a8a6b846efd46ad782811fb7

mscoree

dotnet