asyncrat | 80238ad0d02ba147d5d09e5ec1bbbce2e44f0594502b3b6fa2521a8e7ad8a6fa

Sharing

Copy URL Twitter E-mail

General

Target
80238ad0d02ba147d5d09e5ec1bbbce2e44f0594502b3b6fa2521a8e7ad8a6fa
Size 45KB
Sample260717-sm328set2q
SHA256 80238ad0d02ba147d5d09e5ec1bbbce2e44f0594502b3b6fa2521a8e7ad8a6fa
MD5 0e7f1d1ce59c8f85653f15accb6b0a9a
SHA1 2e19ddd70ea21db3f5636fbde14eca14c811dc9d
SHA512 dc038f7362b3c655ad983a00efed51bf286428ec1a6a146307c2c9dee8df75516ec826ab677a2894a1887cc941a2c6b48d95cb3c2531f4318430d185a9cfbce4
SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbICXtTtSPIDzjbzgX3i0+AU+4t14c0BDZcx:Du2M5TQif2ZwxD3bsXSJbwcCdcx
TLSH
T1D5232C003BE8C12BF2BE5F7899F26145867AF2673603D54E2CC441DB5613BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zephimsexhay.com:80
zephimsexhay.com:22
zephimsexhay.com:8080
zephimsexhay.com:8880
zephimsexhay.com:2052
zephimsexhay.com:2082
zephimsexhay.com:2086
zephimsexhay.com:2095
zephimsexhay.com:443
zephimsexhay.com:2053
zephimsexhay.com:2083
zephimsexhay.com:2087
zephimsexhay.com:2096
zephimsexhay.com:8443
www.zephimsexhay.com:80
www.zephimsexhay.com:22
www.zephimsexhay.com:8080
www.zephimsexhay.com:8880
www.zephimsexhay.com:2052
www.zephimsexhay.com:2082
www.zephimsexhay.com:2086
www.zephimsexhay.com:2095
www.zephimsexhay.com:443
www.zephimsexhay.com:2053
www.zephimsexhay.com:2083
www.zephimsexhay.com:2087
www.zephimsexhay.com:2096
www.zephimsexhay.com:8443
azorult.zephimsexhay.com:80
azorult.zephimsexhay.com:22
azorult.zephimsexhay.com:8080
azorult.zephimsexhay.com:8880
azorult.zephimsexhay.com:2052
azorult.zephimsexhay.com:2082
azorult.zephimsexhay.com:2086
azorult.zephimsexhay.com:2095
azorult.zephimsexhay.com:443
azorult.zephimsexhay.com:2053
azorult.zephimsexhay.com:2083
azorult.zephimsexhay.com:2087
azorult.zephimsexhay.com:2096
azorult.zephimsexhay.com:8443
hermeticwiper.zephimsexhay.com:80
hermeticwiper.zephimsexhay.com:22
hermeticwiper.zephimsexhay.com:8080
hermeticwiper.zephimsexhay.com:8880
hermeticwiper.zephimsexhay.com:2052
hermeticwiper.zephimsexhay.com:2082
hermeticwiper.zephimsexhay.com:2086
hermeticwiper.zephimsexhay.com:2095
hermeticwiper.zephimsexhay.com:443
hermeticwiper.zephimsexhay.com:2053
hermeticwiper.zephimsexhay.com:2083
hermeticwiper.zephimsexhay.com:2087
hermeticwiper.zephimsexhay.com:2096
hermeticwiper.zephimsexhay.com:8443
gootloader.zephimsexhay.com:80
gootloader.zephimsexhay.com:22
gootloader.zephimsexhay.com:8080
gootloader.zephimsexhay.com:8880
gootloader.zephimsexhay.com:2052
gootloader.zephimsexhay.com:2082
gootloader.zephimsexhay.com:2086
gootloader.zephimsexhay.com:2095
gootloader.zephimsexhay.com:443
gootloader.zephimsexhay.com:2053
gootloader.zephimsexhay.com:2083
gootloader.zephimsexhay.com:2087
gootloader.zephimsexhay.com:2096
gootloader.zephimsexhay.com:8443
agenttesla.zephimsexhay.com:80
agenttesla.zephimsexhay.com:22
agenttesla.zephimsexhay.com:8080
agenttesla.zephimsexhay.com:8880
agenttesla.zephimsexhay.com:2052
agenttesla.zephimsexhay.com:2082
agenttesla.zephimsexhay.com:2086
agenttesla.zephimsexhay.com:2095
agenttesla.zephimsexhay.com:443
agenttesla.zephimsexhay.com:2053
agenttesla.zephimsexhay.com:2083
agenttesla.zephimsexhay.com:2087
agenttesla.zephimsexhay.com:2096
agenttesla.zephimsexhay.com:8443

Mutex

IXrubvASjrmz

Attributes

delay
0
install
true
install_file
wqtcw1.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
80238ad0d02ba147d5d09e5ec1bbbce2e44f0594502b3b6fa2521a8e7ad8a6fa

File Explorer

80238ad0d02ba147d5d09e5ec1bbbce2e44f0594502b3b6fa2521a8e7ad8a6fa

.exe 45KB

80238ad0d02ba147d5d09e5ec1bbbce2e44f0594502b3b6fa2521a8e7ad8a6fa

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 80238ad0d02ba147d5d09e5ec1bbbce2e44f0594502b3b6fa2521a8e7ad8a6fa
MD5 0e7f1d1ce59c8f85653f15accb6b0a9a
SHA1 2e19ddd70ea21db3f5636fbde14eca14c811dc9d
SHA512 dc038f7362b3c655ad983a00efed51bf286428ec1a6a146307c2c9dee8df75516ec826ab677a2894a1887cc941a2c6b48d95cb3c2531f4318430d185a9cfbce4
SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbICXtTtSPIDzjbzgX3i0+AU+4t14c0BDZcx:Du2M5TQif2ZwxD3bsXSJbwcCdcx
TLSH
T1D5232C003BE8C12BF2BE5F7899F26145867AF2673603D54E2CC441DB5613BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

80238ad0d02ba147d5d09e5ec1bbbce2e44f0594502b3b6fa2521a8e7ad8a6fa

mscoree

dotnet