asyncrat | da8fb17dde724e15a984f006ebcd89e042734dfa0f1316153c6b313037356f19

Sharing

Copy URL Twitter E-mail

General

Target
da8fb17dde724e15a984f006ebcd89e042734dfa0f1316153c6b313037356f19
Size 45KB
Sample260715-vxethadt6x
SHA256 da8fb17dde724e15a984f006ebcd89e042734dfa0f1316153c6b313037356f19
MD5 3d6411567adcc53f01d757c914ad13af
SHA1 8c6367a657700a50897ade2d7e3c9a496093abeb
SHA512 2415619bcdc549f7be30d224c5ec3d2a74d55379c806902ac73c0b83dddc9d46631ca258da23856a27495acda6e63eee07029e415716206ee36e09bf0fb37fbd
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7fBohEa+PIvijb7gX3iv+xgRKqCYBDZUx:cu7e5TH2A2q4EaHvubEXSvzKRedUx
TLSH
T1B6231A003BE8826BF2BE4F78ADF26145467AF6736603D54E1CC411D75613BC68A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexnhatban.com:80
fimsexnhatban.com:22
fimsexnhatban.com:8080
fimsexnhatban.com:8880
fimsexnhatban.com:2052
fimsexnhatban.com:2082
fimsexnhatban.com:2086
fimsexnhatban.com:2095
fimsexnhatban.com:443
fimsexnhatban.com:2053
fimsexnhatban.com:2083
fimsexnhatban.com:2087
fimsexnhatban.com:2096
fimsexnhatban.com:8443
www.fimsexnhatban.com:80
www.fimsexnhatban.com:22
www.fimsexnhatban.com:8080
www.fimsexnhatban.com:8880
www.fimsexnhatban.com:2052
www.fimsexnhatban.com:2082
www.fimsexnhatban.com:2086
www.fimsexnhatban.com:2095
www.fimsexnhatban.com:443
www.fimsexnhatban.com:2053
www.fimsexnhatban.com:2083
www.fimsexnhatban.com:2087
www.fimsexnhatban.com:2096
www.fimsexnhatban.com:8443
hack.fimsexnhatban.com:80
hack.fimsexnhatban.com:22
hack.fimsexnhatban.com:8080
hack.fimsexnhatban.com:8880
hack.fimsexnhatban.com:2052
hack.fimsexnhatban.com:2082
hack.fimsexnhatban.com:2086
hack.fimsexnhatban.com:2095
hack.fimsexnhatban.com:443
hack.fimsexnhatban.com:2053
hack.fimsexnhatban.com:2083
hack.fimsexnhatban.com:2087
hack.fimsexnhatban.com:2096
hack.fimsexnhatban.com:8443
klez.fimsexnhatban.com:80
klez.fimsexnhatban.com:22
klez.fimsexnhatban.com:8080
klez.fimsexnhatban.com:8880
klez.fimsexnhatban.com:2052
klez.fimsexnhatban.com:2082
klez.fimsexnhatban.com:2086
klez.fimsexnhatban.com:2095
klez.fimsexnhatban.com:443
klez.fimsexnhatban.com:2053
klez.fimsexnhatban.com:2083
klez.fimsexnhatban.com:2087
klez.fimsexnhatban.com:2096
klez.fimsexnhatban.com:8443

Mutex

usIvZay2ASir

Attributes

delay
0
install
true
install_file
xi358.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da8fb17dde724e15a984f006ebcd89e042734dfa0f1316153c6b313037356f19

File Explorer

da8fb17dde724e15a984f006ebcd89e042734dfa0f1316153c6b313037356f19

.exe 45KB

da8fb17dde724e15a984f006ebcd89e042734dfa0f1316153c6b313037356f19

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 da8fb17dde724e15a984f006ebcd89e042734dfa0f1316153c6b313037356f19
MD5 3d6411567adcc53f01d757c914ad13af
SHA1 8c6367a657700a50897ade2d7e3c9a496093abeb
SHA512 2415619bcdc549f7be30d224c5ec3d2a74d55379c806902ac73c0b83dddc9d46631ca258da23856a27495acda6e63eee07029e415716206ee36e09bf0fb37fbd
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7fBohEa+PIvijb7gX3iv+xgRKqCYBDZUx:cu7e5TH2A2q4EaHvubEXSvzKRedUx
TLSH
T1B6231A003BE8826BF2BE4F78ADF26145467AF6736603D54E1CC411D75613BC68A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

da8fb17dde724e15a984f006ebcd89e042734dfa0f1316153c6b313037356f19

mscoree

dotnet