asyncrat | 4fc93d4ace3557a3d822c156186a029fbfda49d7f3389d2e6d705c8b9ffd920b

Sharing

Copy URL Twitter E-mail

General

Target
4fc93d4ace3557a3d822c156186a029fbfda49d7f3389d2e6d705c8b9ffd920b
Size 45KB
Sample260712-dtsgracv3q
SHA256 4fc93d4ace3557a3d822c156186a029fbfda49d7f3389d2e6d705c8b9ffd920b
MD5 ab30738999039214050c11692272b46b
SHA1 8ef758c34e5e873a9330be62e5d2e7e0950e03f0
SHA512 62d3faba2761b961cc8881ad76347bfc5550353a6fe0e73e157014ce1c2f141b09ababd2ddf9dd84286eb5459ffb2deb21504b99e878e8a6f2c9bb6e8fd8952f
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9S9Aa0yPzFOPIRzjbSgx3iUedFsygbvpqJ0BDZ8x:0uPrpT/qY2/ydi3R3bVxSUeIdvpyCd8x
TLSH
T1F0234B003BE9C12BF2BE5B7859F26145467AF2633603D64D1CC452DB5723BC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsec.com:80
fimsec.com:22
fimsec.com:8080
fimsec.com:8880
fimsec.com:2052
fimsec.com:2082
fimsec.com:2086
fimsec.com:2095
fimsec.com:443
fimsec.com:2053
fimsec.com:2083
fimsec.com:2087
fimsec.com:2096
fimsec.com:8443
www.fimsec.com:80
www.fimsec.com:22
www.fimsec.com:8080
www.fimsec.com:8880
www.fimsec.com:2052
www.fimsec.com:2082
www.fimsec.com:2086
www.fimsec.com:2095
www.fimsec.com:443
www.fimsec.com:2053
www.fimsec.com:2083
www.fimsec.com:2087
www.fimsec.com:2096
www.fimsec.com:8443
darkside.fimsec.com:80
darkside.fimsec.com:22
darkside.fimsec.com:8080
darkside.fimsec.com:8880
darkside.fimsec.com:2052
darkside.fimsec.com:2082
darkside.fimsec.com:2086
darkside.fimsec.com:2095
darkside.fimsec.com:443
darkside.fimsec.com:2053
darkside.fimsec.com:2083
darkside.fimsec.com:2087
darkside.fimsec.com:2096
darkside.fimsec.com:8443
blaster.fimsec.com:80
blaster.fimsec.com:22
blaster.fimsec.com:8080
blaster.fimsec.com:8880
blaster.fimsec.com:2052
blaster.fimsec.com:2082
blaster.fimsec.com:2086
blaster.fimsec.com:2095
blaster.fimsec.com:443
blaster.fimsec.com:2053
blaster.fimsec.com:2083
blaster.fimsec.com:2087
blaster.fimsec.com:2096
blaster.fimsec.com:8443
zbot.fimsec.com:80
zbot.fimsec.com:22
zbot.fimsec.com:8080
zbot.fimsec.com:8880
zbot.fimsec.com:2052
zbot.fimsec.com:2082
zbot.fimsec.com:2086
zbot.fimsec.com:2095
zbot.fimsec.com:443
zbot.fimsec.com:2053
zbot.fimsec.com:2083
zbot.fimsec.com:2087
zbot.fimsec.com:2096
zbot.fimsec.com:8443

Mutex

bDyOKGVlaExt

Attributes

delay
0
install
true
install_file
dsfrtbm.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4fc93d4ace3557a3d822c156186a029fbfda49d7f3389d2e6d705c8b9ffd920b

File Explorer

4fc93d4ace3557a3d822c156186a029fbfda49d7f3389d2e6d705c8b9ffd920b

.exe 45KB

4fc93d4ace3557a3d822c156186a029fbfda49d7f3389d2e6d705c8b9ffd920b

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4fc93d4ace3557a3d822c156186a029fbfda49d7f3389d2e6d705c8b9ffd920b
MD5 ab30738999039214050c11692272b46b
SHA1 8ef758c34e5e873a9330be62e5d2e7e0950e03f0
SHA512 62d3faba2761b961cc8881ad76347bfc5550353a6fe0e73e157014ce1c2f141b09ababd2ddf9dd84286eb5459ffb2deb21504b99e878e8a6f2c9bb6e8fd8952f
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9S9Aa0yPzFOPIRzjbSgx3iUedFsygbvpqJ0BDZ8x:0uPrpT/qY2/ydi3R3bVxSUeIdvpyCd8x
TLSH
T1F0234B003BE9C12BF2BE5B7859F26145467AF2633603D64D1CC452DB5723BC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

4fc93d4ace3557a3d822c156186a029fbfda49d7f3389d2e6d705c8b9ffd920b

mscoree

dotnet