asyncrat | 31f6446c632430cd9b8fc91173849990d9508ae611c7a082c1d4b0b057109c67

Sharing

Copy URL Twitter E-mail

General

Target
31f6446c632430cd9b8fc91173849990d9508ae611c7a082c1d4b0b057109c67
Size 45KB
Sample260716-ref23aaz41
SHA256 31f6446c632430cd9b8fc91173849990d9508ae611c7a082c1d4b0b057109c67
MD5 7fbeb3d563d43eb9cd3d33672d8285ab
SHA1 1915f565691942297c5d10b0692e99ea7878fb71
SHA512 9d0ffeb3a5e32d0f1480700d77916d3c171ab9c7ce7e91550bd5f5bbdb14ae8108f119e9a6f5950b39281aa00d86c08ad3ea1ed5b3986cb21ddf4356bf1a2eef
SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjD9wa0y/zFOPIuzjbmgJ3ihkavhxlHQ8frH4BDZ8x:0u2vpTDe+2YCdi3u3b5JShkaNHbzH+d+
TLSH
T1D523290037E8C12BF2BF5F7899F26145867AF6632603D64A1CC4519B4A13FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexnhatban.com:80
fimsexnhatban.com:22
fimsexnhatban.com:8080
fimsexnhatban.com:8880
fimsexnhatban.com:2052
fimsexnhatban.com:2082
fimsexnhatban.com:2086
fimsexnhatban.com:2095
fimsexnhatban.com:443
fimsexnhatban.com:2053
fimsexnhatban.com:2083
fimsexnhatban.com:2087
fimsexnhatban.com:2096
fimsexnhatban.com:8443
www.fimsexnhatban.com:80
www.fimsexnhatban.com:22
www.fimsexnhatban.com:8080
www.fimsexnhatban.com:8880
www.fimsexnhatban.com:2052
www.fimsexnhatban.com:2082
www.fimsexnhatban.com:2086
www.fimsexnhatban.com:2095
www.fimsexnhatban.com:443
www.fimsexnhatban.com:2053
www.fimsexnhatban.com:2083
www.fimsexnhatban.com:2087
www.fimsexnhatban.com:2096
www.fimsexnhatban.com:8443
azorult.fimsexnhatban.com:80
azorult.fimsexnhatban.com:22
azorult.fimsexnhatban.com:8080
azorult.fimsexnhatban.com:8880
azorult.fimsexnhatban.com:2052
azorult.fimsexnhatban.com:2082
azorult.fimsexnhatban.com:2086
azorult.fimsexnhatban.com:2095
azorult.fimsexnhatban.com:443
azorult.fimsexnhatban.com:2053
azorult.fimsexnhatban.com:2083
azorult.fimsexnhatban.com:2087
azorult.fimsexnhatban.com:2096
azorult.fimsexnhatban.com:8443
invasive.fimsexnhatban.com:80
invasive.fimsexnhatban.com:22
invasive.fimsexnhatban.com:8080
invasive.fimsexnhatban.com:8880
invasive.fimsexnhatban.com:2052
invasive.fimsexnhatban.com:2082
invasive.fimsexnhatban.com:2086
invasive.fimsexnhatban.com:2095
invasive.fimsexnhatban.com:443
invasive.fimsexnhatban.com:2053
invasive.fimsexnhatban.com:2083
invasive.fimsexnhatban.com:2087
invasive.fimsexnhatban.com:2096
invasive.fimsexnhatban.com:8443
gozi.fimsexnhatban.com:80
gozi.fimsexnhatban.com:22
gozi.fimsexnhatban.com:8080
gozi.fimsexnhatban.com:8880
gozi.fimsexnhatban.com:2052
gozi.fimsexnhatban.com:2082
gozi.fimsexnhatban.com:2086
gozi.fimsexnhatban.com:2095
gozi.fimsexnhatban.com:443
gozi.fimsexnhatban.com:2053
gozi.fimsexnhatban.com:2083
gozi.fimsexnhatban.com:2087
gozi.fimsexnhatban.com:2096
gozi.fimsexnhatban.com:8443
darkside.fimsexnhatban.com:80
darkside.fimsexnhatban.com:22
darkside.fimsexnhatban.com:8080
darkside.fimsexnhatban.com:8880
darkside.fimsexnhatban.com:2052
darkside.fimsexnhatban.com:2082
darkside.fimsexnhatban.com:2086
darkside.fimsexnhatban.com:2095
darkside.fimsexnhatban.com:443
darkside.fimsexnhatban.com:2053
darkside.fimsexnhatban.com:2083
darkside.fimsexnhatban.com:2087
darkside.fimsexnhatban.com:2096
darkside.fimsexnhatban.com:8443

Mutex

EBQpESe4yLAP

Attributes

delay
0
install
true
install_file
yz9qy9m.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31f6446c632430cd9b8fc91173849990d9508ae611c7a082c1d4b0b057109c67

File Explorer

31f6446c632430cd9b8fc91173849990d9508ae611c7a082c1d4b0b057109c67

.exe 45KB

31f6446c632430cd9b8fc91173849990d9508ae611c7a082c1d4b0b057109c67

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 31f6446c632430cd9b8fc91173849990d9508ae611c7a082c1d4b0b057109c67
MD5 7fbeb3d563d43eb9cd3d33672d8285ab
SHA1 1915f565691942297c5d10b0692e99ea7878fb71
SHA512 9d0ffeb3a5e32d0f1480700d77916d3c171ab9c7ce7e91550bd5f5bbdb14ae8108f119e9a6f5950b39281aa00d86c08ad3ea1ed5b3986cb21ddf4356bf1a2eef
SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjD9wa0y/zFOPIuzjbmgJ3ihkavhxlHQ8frH4BDZ8x:0u2vpTDe+2YCdi3u3b5JShkaNHbzH+d+
TLSH
T1D523290037E8C12BF2BF5F7899F26145867AF6632603D64A1CC4519B4A13FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

31f6446c632430cd9b8fc91173849990d9508ae611c7a082c1d4b0b057109c67

mscoree

dotnet