asyncrat | 150a6505090bd6cad7cbda8dcc8051cc18c8cb731cc378ea9a31e7bfc6087b54

Sharing

Copy URL Twitter E-mail

General

Target
150a6505090bd6cad7cbda8dcc8051cc18c8cb731cc378ea9a31e7bfc6087b54
Size 45KB
Sample260712-ty5wmsds4j
SHA256 150a6505090bd6cad7cbda8dcc8051cc18c8cb731cc378ea9a31e7bfc6087b54
MD5 6f88d2345c4a18e1e2999cba7b5ed0c9
SHA1 7f194d67006d0b4ef9e8acc754872e2b2452d29b
SHA512 f4d186c8355be503c27bf60a71dd4094223bec69ee908d92fa32878382b0f04cc6c1372ca9bc0826bd2300bc18e5a0e6455f423a05486d075765393cf3d3337e
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwg3xY6aZOOPIgzjbCgJ3iVs9VNlWraNqfpBDZMx:ku40ZTXEb2cu/O3g3blJS+3Nl6aNQdMx
TLSH
T147232B003BE8812BF2BE5F78ACF26145467AF6632603D54A1CC451DB5B13FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s1.viet69sex.blog:80
s1.viet69sex.blog:22
s1.viet69sex.blog:8080
s1.viet69sex.blog:8880
s1.viet69sex.blog:2052
s1.viet69sex.blog:2082
s1.viet69sex.blog:2086
s1.viet69sex.blog:2095
s1.viet69sex.blog:443
s1.viet69sex.blog:2053
s1.viet69sex.blog:2083
s1.viet69sex.blog:2087
s1.viet69sex.blog:2096
s1.viet69sex.blog:8443
www.s1.viet69sex.blog:80
www.s1.viet69sex.blog:22
www.s1.viet69sex.blog:8080
www.s1.viet69sex.blog:8880
www.s1.viet69sex.blog:2052
www.s1.viet69sex.blog:2082
www.s1.viet69sex.blog:2086
www.s1.viet69sex.blog:2095
www.s1.viet69sex.blog:443
www.s1.viet69sex.blog:2053
www.s1.viet69sex.blog:2083
www.s1.viet69sex.blog:2087
www.s1.viet69sex.blog:2096
www.s1.viet69sex.blog:8443
nimda.s1.viet69sex.blog:80
nimda.s1.viet69sex.blog:22
nimda.s1.viet69sex.blog:8080
nimda.s1.viet69sex.blog:8880
nimda.s1.viet69sex.blog:2052
nimda.s1.viet69sex.blog:2082
nimda.s1.viet69sex.blog:2086
nimda.s1.viet69sex.blog:2095
nimda.s1.viet69sex.blog:443
nimda.s1.viet69sex.blog:2053
nimda.s1.viet69sex.blog:2083
nimda.s1.viet69sex.blog:2087
nimda.s1.viet69sex.blog:2096
nimda.s1.viet69sex.blog:8443
zbot.s1.viet69sex.blog:80
zbot.s1.viet69sex.blog:22
zbot.s1.viet69sex.blog:8080
zbot.s1.viet69sex.blog:8880
zbot.s1.viet69sex.blog:2052
zbot.s1.viet69sex.blog:2082
zbot.s1.viet69sex.blog:2086
zbot.s1.viet69sex.blog:2095
zbot.s1.viet69sex.blog:443
zbot.s1.viet69sex.blog:2053
zbot.s1.viet69sex.blog:2083
zbot.s1.viet69sex.blog:2087
zbot.s1.viet69sex.blog:2096
zbot.s1.viet69sex.blog:8443
invasive.s1.viet69sex.blog:80
invasive.s1.viet69sex.blog:22
invasive.s1.viet69sex.blog:8080
invasive.s1.viet69sex.blog:8880
invasive.s1.viet69sex.blog:2052
invasive.s1.viet69sex.blog:2082
invasive.s1.viet69sex.blog:2086
invasive.s1.viet69sex.blog:2095
invasive.s1.viet69sex.blog:443
invasive.s1.viet69sex.blog:2053
invasive.s1.viet69sex.blog:2083
invasive.s1.viet69sex.blog:2087
invasive.s1.viet69sex.blog:2096
invasive.s1.viet69sex.blog:8443

Mutex

m7Bjs0GdFimu

Attributes

delay
0
install
true
install_file
zpv8j.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
150a6505090bd6cad7cbda8dcc8051cc18c8cb731cc378ea9a31e7bfc6087b54

File Explorer

150a6505090bd6cad7cbda8dcc8051cc18c8cb731cc378ea9a31e7bfc6087b54

.exe 45KB

150a6505090bd6cad7cbda8dcc8051cc18c8cb731cc378ea9a31e7bfc6087b54

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 150a6505090bd6cad7cbda8dcc8051cc18c8cb731cc378ea9a31e7bfc6087b54
MD5 6f88d2345c4a18e1e2999cba7b5ed0c9
SHA1 7f194d67006d0b4ef9e8acc754872e2b2452d29b
SHA512 f4d186c8355be503c27bf60a71dd4094223bec69ee908d92fa32878382b0f04cc6c1372ca9bc0826bd2300bc18e5a0e6455f423a05486d075765393cf3d3337e
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwg3xY6aZOOPIgzjbCgJ3iVs9VNlWraNqfpBDZMx:ku40ZTXEb2cu/O3g3blJS+3Nl6aNQdMx
TLSH
T147232B003BE8812BF2BE5F78ACF26145467AF6632603D54A1CC451DB5B13FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

150a6505090bd6cad7cbda8dcc8051cc18c8cb731cc378ea9a31e7bfc6087b54

mscoree

dotnet