asyncrat | 1c2d4fb7620835d45ac06c9a6bf500a87682850010a001b968dc7eb630cd2696

Sharing

Copy URL Twitter E-mail

General

Target
1c2d4fb7620835d45ac06c9a6bf500a87682850010a001b968dc7eb630cd2696
Size 45KB
Sample260712-s3kwlact2p
SHA256 1c2d4fb7620835d45ac06c9a6bf500a87682850010a001b968dc7eb630cd2696
MD5 86504649a5217ab1db0ac9e56aed1882
SHA1 6682b289b387b255e00f59a64143f7c21b92b8ea
SHA512 f4136788b12f299d41c1868f544f26e93a5ed2b2029ab5a565afbb59ad7faa50b1abcc88a8262459ec0c1059d129947f8222eed45208a2775254056f29d4f3d3
SSDEEP 768:QuflpT8AkKuWUch7wmo2q9HozHyvCKPIizjbsgX3izBeDf5VS5tAAdrcBDZTx:QuflpT8Hv2pL5i3bjXSzMPAdudTx
TLSH
T1AD232B003BE9C12BF2BE5F7859F22245867AF6633A03D68D1CC411DB1613BC58A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vlxx.moi:80
vlxx.moi:22
vlxx.moi:8080
vlxx.moi:8880
vlxx.moi:2052
vlxx.moi:2082
vlxx.moi:2086
vlxx.moi:2095
vlxx.moi:443
vlxx.moi:2053
vlxx.moi:2083
vlxx.moi:2087
vlxx.moi:2096
vlxx.moi:8443
www.vlxx.moi:80
www.vlxx.moi:22
www.vlxx.moi:8080
www.vlxx.moi:8880
www.vlxx.moi:2052
www.vlxx.moi:2082
www.vlxx.moi:2086
www.vlxx.moi:2095
www.vlxx.moi:443
www.vlxx.moi:2053
www.vlxx.moi:2083
www.vlxx.moi:2087
www.vlxx.moi:2096
www.vlxx.moi:8443
darkside.vlxx.moi:80
darkside.vlxx.moi:22
darkside.vlxx.moi:8080
darkside.vlxx.moi:8880
darkside.vlxx.moi:2052
darkside.vlxx.moi:2082
darkside.vlxx.moi:2086
darkside.vlxx.moi:2095
darkside.vlxx.moi:443
darkside.vlxx.moi:2053
darkside.vlxx.moi:2083
darkside.vlxx.moi:2087
darkside.vlxx.moi:2096
darkside.vlxx.moi:8443
codered.vlxx.moi:80
codered.vlxx.moi:22
codered.vlxx.moi:8080
codered.vlxx.moi:8880
codered.vlxx.moi:2052
codered.vlxx.moi:2082
codered.vlxx.moi:2086
codered.vlxx.moi:2095
codered.vlxx.moi:443
codered.vlxx.moi:2053
codered.vlxx.moi:2083
codered.vlxx.moi:2087
codered.vlxx.moi:2096
codered.vlxx.moi:8443

Mutex

X5MBFMHW80fn

Attributes

delay
0
install
true
install_file
zdjo4ta.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c2d4fb7620835d45ac06c9a6bf500a87682850010a001b968dc7eb630cd2696

File Explorer

1c2d4fb7620835d45ac06c9a6bf500a87682850010a001b968dc7eb630cd2696

.exe 45KB

1c2d4fb7620835d45ac06c9a6bf500a87682850010a001b968dc7eb630cd2696

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1c2d4fb7620835d45ac06c9a6bf500a87682850010a001b968dc7eb630cd2696
MD5 86504649a5217ab1db0ac9e56aed1882
SHA1 6682b289b387b255e00f59a64143f7c21b92b8ea
SHA512 f4136788b12f299d41c1868f544f26e93a5ed2b2029ab5a565afbb59ad7faa50b1abcc88a8262459ec0c1059d129947f8222eed45208a2775254056f29d4f3d3
SSDEEP 768:QuflpT8AkKuWUch7wmo2q9HozHyvCKPIizjbsgX3izBeDf5VS5tAAdrcBDZTx:QuflpT8Hv2pL5i3bjXSzMPAdudTx
TLSH
T1AD232B003BE9C12BF2BE5F7859F22245867AF6633A03D68D1CC411DB1613BC58A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

1c2d4fb7620835d45ac06c9a6bf500a87682850010a001b968dc7eb630cd2696

mscoree

dotnet