asyncrat | 80a1c548b67adda45023842185bf5047fbf6d2fdeb5fc8234168cef4f51e5b36

Sharing

Copy URL Twitter E-mail

General

Target
80a1c548b67adda45023842185bf5047fbf6d2fdeb5fc8234168cef4f51e5b36
Size 45KB
Sample260716-mlvftaaw6j
SHA256 80a1c548b67adda45023842185bf5047fbf6d2fdeb5fc8234168cef4f51e5b36
MD5 0a98e2964472d4f4ca815e5b83a5e3e0
SHA1 f9fff5b5d5703efb86182cb0a9e54e77b5ebd57c
SHA512 0b84a19139cb60607fc2c60c0abf27f40caa627c5621e5910634411afd6e1d3376e4c7e1d3d5fe10fd3f28fd015bf62533d511e5a83669b10164a94678d3cea5
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwP3Fo9EaOPIszjbtgX3i40gFieOuBpBDZMx:ku40ZTXEb258Ea3s3b6XSEApuB3dMx
TLSH
T148232A003BE8826BF2BE4F78ADF26245867AF1632603D54A1CC411D75713BC6DA52AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zephimsexhay.com:80
zephimsexhay.com:22
zephimsexhay.com:8080
zephimsexhay.com:8880
zephimsexhay.com:2052
zephimsexhay.com:2082
zephimsexhay.com:2086
zephimsexhay.com:2095
zephimsexhay.com:443
zephimsexhay.com:2053
zephimsexhay.com:2083
zephimsexhay.com:2087
zephimsexhay.com:2096
zephimsexhay.com:8443
www.zephimsexhay.com:80
www.zephimsexhay.com:22
www.zephimsexhay.com:8080
www.zephimsexhay.com:8880
www.zephimsexhay.com:2052
www.zephimsexhay.com:2082
www.zephimsexhay.com:2086
www.zephimsexhay.com:2095
www.zephimsexhay.com:443
www.zephimsexhay.com:2053
www.zephimsexhay.com:2083
www.zephimsexhay.com:2087
www.zephimsexhay.com:2096
www.zephimsexhay.com:8443
blacklotus.zephimsexhay.com:80
blacklotus.zephimsexhay.com:22
blacklotus.zephimsexhay.com:8080
blacklotus.zephimsexhay.com:8880
blacklotus.zephimsexhay.com:2052
blacklotus.zephimsexhay.com:2082
blacklotus.zephimsexhay.com:2086
blacklotus.zephimsexhay.com:2095
blacklotus.zephimsexhay.com:443
blacklotus.zephimsexhay.com:2053
blacklotus.zephimsexhay.com:2083
blacklotus.zephimsexhay.com:2087
blacklotus.zephimsexhay.com:2096
blacklotus.zephimsexhay.com:8443
sasser.zephimsexhay.com:80
sasser.zephimsexhay.com:22
sasser.zephimsexhay.com:8080
sasser.zephimsexhay.com:8880
sasser.zephimsexhay.com:2052
sasser.zephimsexhay.com:2082
sasser.zephimsexhay.com:2086
sasser.zephimsexhay.com:2095
sasser.zephimsexhay.com:443
sasser.zephimsexhay.com:2053
sasser.zephimsexhay.com:2083
sasser.zephimsexhay.com:2087
sasser.zephimsexhay.com:2096
sasser.zephimsexhay.com:8443
invasive.zephimsexhay.com:80
invasive.zephimsexhay.com:22
invasive.zephimsexhay.com:8080
invasive.zephimsexhay.com:8880
invasive.zephimsexhay.com:2052
invasive.zephimsexhay.com:2082
invasive.zephimsexhay.com:2086
invasive.zephimsexhay.com:2095
invasive.zephimsexhay.com:443
invasive.zephimsexhay.com:2053
invasive.zephimsexhay.com:2083
invasive.zephimsexhay.com:2087
invasive.zephimsexhay.com:2096
invasive.zephimsexhay.com:8443

Mutex

HCiiuh7z16XB

Attributes

delay
0
install
true
install_file
121d3.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
80a1c548b67adda45023842185bf5047fbf6d2fdeb5fc8234168cef4f51e5b36

File Explorer

80a1c548b67adda45023842185bf5047fbf6d2fdeb5fc8234168cef4f51e5b36

.exe 45KB

80a1c548b67adda45023842185bf5047fbf6d2fdeb5fc8234168cef4f51e5b36

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 80a1c548b67adda45023842185bf5047fbf6d2fdeb5fc8234168cef4f51e5b36
MD5 0a98e2964472d4f4ca815e5b83a5e3e0
SHA1 f9fff5b5d5703efb86182cb0a9e54e77b5ebd57c
SHA512 0b84a19139cb60607fc2c60c0abf27f40caa627c5621e5910634411afd6e1d3376e4c7e1d3d5fe10fd3f28fd015bf62533d511e5a83669b10164a94678d3cea5
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwP3Fo9EaOPIszjbtgX3i40gFieOuBpBDZMx:ku40ZTXEb258Ea3s3b6XSEApuB3dMx
TLSH
T148232A003BE8826BF2BE4F78ADF26245867AF1632603D54A1CC411D75713BC6DA52AFD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

80a1c548b67adda45023842185bf5047fbf6d2fdeb5fc8234168cef4f51e5b36

mscoree

dotnet