asyncrat | 31922453631670ec54abc078b4632669e298add291526fcefd69c590bcd6e7c9

Sharing

Copy URL Twitter E-mail

General

Target
31922453631670ec54abc078b4632669e298add291526fcefd69c590bcd6e7c9
Size 45KB
Sample260718-rcpanagv61
SHA256 31922453631670ec54abc078b4632669e298add291526fcefd69c590bcd6e7c9
MD5 71696a9d15bbc55c1b388601f9948ac8
SHA1 86663a02ec04d869e5d23bf049f799d0995cea19
SHA512 83549886ff5134f84d772822fafd05132220c8a7e9c77d8082747aa710152f574b8c74f87dc9025018c60a1cd4bced2203c4869f9932b1c291c42e8719d2264c
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q192q0CCMPd4CvS8PIm4jb1gX3im3F/u4e1wQMdxKGfW:cuR0JTPjY2kRCEWBmwbSXSm124EwQMdw
TLSH
T103232A003BE9812BF2BE4B78A9F26145467AF5732603D64E1CC451DB5723FC68643AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

dagatructiep.sh:80
dagatructiep.sh:22
dagatructiep.sh:8080
dagatructiep.sh:8880
dagatructiep.sh:2052
dagatructiep.sh:2082
dagatructiep.sh:2086
dagatructiep.sh:2095
dagatructiep.sh:443
dagatructiep.sh:2053
dagatructiep.sh:2083
dagatructiep.sh:2087
dagatructiep.sh:2096
dagatructiep.sh:8443
www.dagatructiep.sh:80
www.dagatructiep.sh:22
www.dagatructiep.sh:8080
www.dagatructiep.sh:8880
www.dagatructiep.sh:2052
www.dagatructiep.sh:2082
www.dagatructiep.sh:2086
www.dagatructiep.sh:2095
www.dagatructiep.sh:443
www.dagatructiep.sh:2053
www.dagatructiep.sh:2083
www.dagatructiep.sh:2087
www.dagatructiep.sh:2096
www.dagatructiep.sh:8443
remcos.dagatructiep.sh:80
remcos.dagatructiep.sh:22
remcos.dagatructiep.sh:8080
remcos.dagatructiep.sh:8880
remcos.dagatructiep.sh:2052
remcos.dagatructiep.sh:2082
remcos.dagatructiep.sh:2086
remcos.dagatructiep.sh:2095
remcos.dagatructiep.sh:443
remcos.dagatructiep.sh:2053
remcos.dagatructiep.sh:2083
remcos.dagatructiep.sh:2087
remcos.dagatructiep.sh:2096
remcos.dagatructiep.sh:8443
wannacry.dagatructiep.sh:80
wannacry.dagatructiep.sh:22
wannacry.dagatructiep.sh:8080
wannacry.dagatructiep.sh:8880
wannacry.dagatructiep.sh:2052
wannacry.dagatructiep.sh:2082
wannacry.dagatructiep.sh:2086
wannacry.dagatructiep.sh:2095
wannacry.dagatructiep.sh:443
wannacry.dagatructiep.sh:2053
wannacry.dagatructiep.sh:2083
wannacry.dagatructiep.sh:2087
wannacry.dagatructiep.sh:2096
wannacry.dagatructiep.sh:8443

Mutex

RoNSntHBFTlW

Attributes

delay
0
install
true
install_file
fa6d.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31922453631670ec54abc078b4632669e298add291526fcefd69c590bcd6e7c9

File Explorer

31922453631670ec54abc078b4632669e298add291526fcefd69c590bcd6e7c9

.exe 45KB

31922453631670ec54abc078b4632669e298add291526fcefd69c590bcd6e7c9

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 31922453631670ec54abc078b4632669e298add291526fcefd69c590bcd6e7c9
MD5 71696a9d15bbc55c1b388601f9948ac8
SHA1 86663a02ec04d869e5d23bf049f799d0995cea19
SHA512 83549886ff5134f84d772822fafd05132220c8a7e9c77d8082747aa710152f574b8c74f87dc9025018c60a1cd4bced2203c4869f9932b1c291c42e8719d2264c
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q192q0CCMPd4CvS8PIm4jb1gX3im3F/u4e1wQMdxKGfW:cuR0JTPjY2kRCEWBmwbSXSm124EwQMdw
TLSH
T103232A003BE9812BF2BE4B78A9F26145467AF5732603D64E1CC451DB5723FC68643AEE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

31922453631670ec54abc078b4632669e298add291526fcefd69c590bcd6e7c9

mscoree

dotnet