asyncrat | c017a04b0a514972727fbe6015c2b9d40d2ec5a6b47e11aef84f602da388b9d7

Sharing

Copy URL Twitter E-mail

General

Target
c017a04b0a514972727fbe6015c2b9d40d2ec5a6b47e11aef84f602da388b9d7
Size 45KB
Sample260712-c7n6tab12p
SHA256 c017a04b0a514972727fbe6015c2b9d40d2ec5a6b47e11aef84f602da388b9d7
MD5 5552319c4a1d0c69af852dea0113e244
SHA1 b56a9c4cae29e21d583b4ea187625f4acd967f89
SHA512 a6201e38bbebec390b81925b078746698868d20321b4e2d254a5072c3e9d8fe502b513a0c75ab8a0d57bae0758eb06cf77165fa0bf2e244c2df6a5e0104b532c
SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPcl83APITpzjb9gX3iSNV5d6oNg5mv+PBDZkx:suJdpTPdI2HfcS3lTp3bqXSGIgz+5dkx
TLSH
T1ED233A003BE8C12BF2BE4F7899F26145467AF6636603D64D1CC852DB5623FC6CA426F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

asentv.tv:80
asentv.tv:22
asentv.tv:8080
asentv.tv:8880
asentv.tv:2052
asentv.tv:2082
asentv.tv:2086
asentv.tv:2095
asentv.tv:443
asentv.tv:2053
asentv.tv:2083
asentv.tv:2087
asentv.tv:2096
asentv.tv:8443
www.asentv.tv:80
www.asentv.tv:22
www.asentv.tv:8080
www.asentv.tv:8880
www.asentv.tv:2052
www.asentv.tv:2082
www.asentv.tv:2086
www.asentv.tv:2095
www.asentv.tv:443
www.asentv.tv:2053
www.asentv.tv:2083
www.asentv.tv:2087
www.asentv.tv:2096
www.asentv.tv:8443
lokibot.asentv.tv:80
lokibot.asentv.tv:22
lokibot.asentv.tv:8080
lokibot.asentv.tv:8880
lokibot.asentv.tv:2052
lokibot.asentv.tv:2082
lokibot.asentv.tv:2086
lokibot.asentv.tv:2095
lokibot.asentv.tv:443
lokibot.asentv.tv:2053
lokibot.asentv.tv:2083
lokibot.asentv.tv:2087
lokibot.asentv.tv:2096
lokibot.asentv.tv:8443
triton.asentv.tv:80
triton.asentv.tv:22
triton.asentv.tv:8080
triton.asentv.tv:8880
triton.asentv.tv:2052
triton.asentv.tv:2082
triton.asentv.tv:2086
triton.asentv.tv:2095
triton.asentv.tv:443
triton.asentv.tv:2053
triton.asentv.tv:2083
triton.asentv.tv:2087
triton.asentv.tv:2096
triton.asentv.tv:8443
sobig.asentv.tv:80
sobig.asentv.tv:22
sobig.asentv.tv:8080
sobig.asentv.tv:8880
sobig.asentv.tv:2052
sobig.asentv.tv:2082
sobig.asentv.tv:2086
sobig.asentv.tv:2095
sobig.asentv.tv:443
sobig.asentv.tv:2053
sobig.asentv.tv:2083
sobig.asentv.tv:2087
sobig.asentv.tv:2096
sobig.asentv.tv:8443
revil.asentv.tv:80
revil.asentv.tv:22
revil.asentv.tv:8080
revil.asentv.tv:8880
revil.asentv.tv:2052
revil.asentv.tv:2082
revil.asentv.tv:2086
revil.asentv.tv:2095
revil.asentv.tv:443
revil.asentv.tv:2053
revil.asentv.tv:2083
revil.asentv.tv:2087
revil.asentv.tv:2096
revil.asentv.tv:8443

Mutex

lZOqBaV2a9z5

Attributes

delay
0
install
true
install_file
st5zv6tu.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c017a04b0a514972727fbe6015c2b9d40d2ec5a6b47e11aef84f602da388b9d7

File Explorer

c017a04b0a514972727fbe6015c2b9d40d2ec5a6b47e11aef84f602da388b9d7

.exe 45KB

c017a04b0a514972727fbe6015c2b9d40d2ec5a6b47e11aef84f602da388b9d7

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c017a04b0a514972727fbe6015c2b9d40d2ec5a6b47e11aef84f602da388b9d7
MD5 5552319c4a1d0c69af852dea0113e244
SHA1 b56a9c4cae29e21d583b4ea187625f4acd967f89
SHA512 a6201e38bbebec390b81925b078746698868d20321b4e2d254a5072c3e9d8fe502b513a0c75ab8a0d57bae0758eb06cf77165fa0bf2e244c2df6a5e0104b532c
SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPcl83APITpzjb9gX3iSNV5d6oNg5mv+PBDZkx:suJdpTPdI2HfcS3lTp3bqXSGIgz+5dkx
TLSH
T1ED233A003BE8C12BF2BE4F7899F26145467AF6636603D64D1CC852DB5623FC6CA426F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c017a04b0a514972727fbe6015c2b9d40d2ec5a6b47e11aef84f602da388b9d7

mscoree

dotnet