asyncrat | 78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee

Sharing

Copy URL Twitter E-mail

General

Target
78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee
Size 45KB
Sample260718-thttfaav3t
SHA256 78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee
MD5 1e22d9e1aaa721ab93186adcc5fec048
SHA1 2d85037a530670b9882e9ebfcb906ec5c62bfaaf
SHA512 2aba6b49a6806362243371b5e51fafa5444f4ff710692aa78b4703f67c11d9f661e9420c54f3a6b91985a676ee4c2f4776ea221951d54975ff605b89445d958d
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AcQSCBznqNLPI7zjb4gX3iMgyalNlBxuBDZsx:EufspTf2g2Jc9UqC73bvXSMgyvdsx
TLSH
T128232B003BE8812AF1BE4F78A8F26145867AF6637603E94D2CC451DB5A13FC6D6426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

chichgai.one:80
chichgai.one:22
chichgai.one:8080
chichgai.one:8880
chichgai.one:2052
chichgai.one:2082
chichgai.one:2086
chichgai.one:2095
chichgai.one:443
chichgai.one:2053
chichgai.one:2083
chichgai.one:2087
chichgai.one:2096
chichgai.one:8443
www.chichgai.one:80
www.chichgai.one:22
www.chichgai.one:8080
www.chichgai.one:8880
www.chichgai.one:2052
www.chichgai.one:2082
www.chichgai.one:2086
www.chichgai.one:2095
www.chichgai.one:443
www.chichgai.one:2053
www.chichgai.one:2083
www.chichgai.one:2087
www.chichgai.one:2096
www.chichgai.one:8443
rat.chichgai.one:80
rat.chichgai.one:22
rat.chichgai.one:8080
rat.chichgai.one:8880
rat.chichgai.one:2052
rat.chichgai.one:2082
rat.chichgai.one:2086
rat.chichgai.one:2095
rat.chichgai.one:443
rat.chichgai.one:2053
rat.chichgai.one:2083
rat.chichgai.one:2087
rat.chichgai.one:2096
rat.chichgai.one:8443
qakbot.chichgai.one:80
qakbot.chichgai.one:22
qakbot.chichgai.one:8080
qakbot.chichgai.one:8880
qakbot.chichgai.one:2052
qakbot.chichgai.one:2082
qakbot.chichgai.one:2086
qakbot.chichgai.one:2095
qakbot.chichgai.one:443
qakbot.chichgai.one:2053
qakbot.chichgai.one:2083
qakbot.chichgai.one:2087
qakbot.chichgai.one:2096
qakbot.chichgai.one:8443
client.chichgai.one:80
client.chichgai.one:22
client.chichgai.one:8080
client.chichgai.one:8880
client.chichgai.one:2052
client.chichgai.one:2082
client.chichgai.one:2086
client.chichgai.one:2095
client.chichgai.one:443
client.chichgai.one:2053
client.chichgai.one:2083
client.chichgai.one:2087
client.chichgai.one:2096
client.chichgai.one:8443
socgholish.chichgai.one:80
socgholish.chichgai.one:22
socgholish.chichgai.one:8080
socgholish.chichgai.one:8880
socgholish.chichgai.one:2052
socgholish.chichgai.one:2082
socgholish.chichgai.one:2086
socgholish.chichgai.one:2095
socgholish.chichgai.one:443
socgholish.chichgai.one:2053
socgholish.chichgai.one:2083
socgholish.chichgai.one:2087
socgholish.chichgai.one:2096
socgholish.chichgai.one:8443

Mutex

8UjEGyuV53CB

Attributes

delay
0
install
true
install_file
n1b8juz.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee

File Explorer

78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee

.exe 45KB

78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee
MD5 1e22d9e1aaa721ab93186adcc5fec048
SHA1 2d85037a530670b9882e9ebfcb906ec5c62bfaaf
SHA512 2aba6b49a6806362243371b5e51fafa5444f4ff710692aa78b4703f67c11d9f661e9420c54f3a6b91985a676ee4c2f4776ea221951d54975ff605b89445d958d
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AcQSCBznqNLPI7zjb4gX3iMgyalNlBxuBDZsx:EufspTf2g2Jc9UqC73bvXSMgyvdsx
TLSH
T128232B003BE8812AF1BE4F78A8F26145867AF6637603E94D2CC451DB5A13FC6D6426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

78ec3952a0176f19a1c7d40f3f96996188fd9d0fd72a8bb857639c73d8a745ee

mscoree

dotnet