asyncrat | 78fd3664ce88f8a51e8fd8280f987f930276f0497f597430b0aeedfde99a40f7

Sharing

Copy URL Twitter E-mail

General

Target
78fd3664ce88f8a51e8fd8280f987f930276f0497f597430b0aeedfde99a40f7
Size 45KB
Sample260720-rvg93afs21
SHA256 78fd3664ce88f8a51e8fd8280f987f930276f0497f597430b0aeedfde99a40f7
MD5 f495389699d7227e52a5b3e4d4fa04b2
SHA1 5be945403a39fe1a045c53083673025c4579f674
SHA512 b7438c7335ad3829419ca256a3ac810ea965248b52f7e4080f3d3708b74c08309f9fc98036c2ad873a2dbe2a16fe5a2408cb478cf40c3e6c68253dd6a755a95b
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAu0ewtDc30oiZPI/zjbQgX3iQYHZElHvHbY4PbBDg:cuqNJTLr62gwR2iW/3bXXSQYqlDYsNdW
TLSH
T11B2329003BE9812BF2BE4F7898F26245867AF6633603D5491CC451DB5713FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

jikklimokmk125:80
jikklimokmk125:22
jikklimokmk125:8080
jikklimokmk125:8880
jikklimokmk125:2052
jikklimokmk125:2082
jikklimokmk125:2086
jikklimokmk125:2095
jikklimokmk125:443
jikklimokmk125:2053
jikklimokmk125:2083
jikklimokmk125:2087
jikklimokmk125:2096
jikklimokmk125:8443
www.jikklimokmk125:80
www.jikklimokmk125:22
www.jikklimokmk125:8080
www.jikklimokmk125:8880
www.jikklimokmk125:2052
www.jikklimokmk125:2082
www.jikklimokmk125:2086
www.jikklimokmk125:2095
www.jikklimokmk125:443
www.jikklimokmk125:2053
www.jikklimokmk125:2083
www.jikklimokmk125:2087
www.jikklimokmk125:2096
www.jikklimokmk125:8443
agenttesla.jikklimokmk125:80
agenttesla.jikklimokmk125:22
agenttesla.jikklimokmk125:8080
agenttesla.jikklimokmk125:8880
agenttesla.jikklimokmk125:2052
agenttesla.jikklimokmk125:2082
agenttesla.jikklimokmk125:2086
agenttesla.jikklimokmk125:2095
agenttesla.jikklimokmk125:443
agenttesla.jikklimokmk125:2053
agenttesla.jikklimokmk125:2083
agenttesla.jikklimokmk125:2087
agenttesla.jikklimokmk125:2096
agenttesla.jikklimokmk125:8443
qakbot.jikklimokmk125:80
qakbot.jikklimokmk125:22
qakbot.jikklimokmk125:8080
qakbot.jikklimokmk125:8880
qakbot.jikklimokmk125:2052
qakbot.jikklimokmk125:2082
qakbot.jikklimokmk125:2086
qakbot.jikklimokmk125:2095
qakbot.jikklimokmk125:443
qakbot.jikklimokmk125:2053
qakbot.jikklimokmk125:2083
qakbot.jikklimokmk125:2087
qakbot.jikklimokmk125:2096
qakbot.jikklimokmk125:8443
iloveyou.jikklimokmk125:80
iloveyou.jikklimokmk125:22
iloveyou.jikklimokmk125:8080
iloveyou.jikklimokmk125:8880
iloveyou.jikklimokmk125:2052
iloveyou.jikklimokmk125:2082
iloveyou.jikklimokmk125:2086
iloveyou.jikklimokmk125:2095
iloveyou.jikklimokmk125:443
iloveyou.jikklimokmk125:2053
iloveyou.jikklimokmk125:2083
iloveyou.jikklimokmk125:2087
iloveyou.jikklimokmk125:2096
iloveyou.jikklimokmk125:8443
stuxnet.jikklimokmk125:80
stuxnet.jikklimokmk125:22
stuxnet.jikklimokmk125:8080
stuxnet.jikklimokmk125:8880
stuxnet.jikklimokmk125:2052
stuxnet.jikklimokmk125:2082
stuxnet.jikklimokmk125:2086
stuxnet.jikklimokmk125:2095
stuxnet.jikklimokmk125:443
stuxnet.jikklimokmk125:2053
stuxnet.jikklimokmk125:2083
stuxnet.jikklimokmk125:2087
stuxnet.jikklimokmk125:2096
stuxnet.jikklimokmk125:8443

Mutex

1IrYrFkRxPvB

Attributes

delay
0
install
true
install_file
7ovf.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78fd3664ce88f8a51e8fd8280f987f930276f0497f597430b0aeedfde99a40f7

File Explorer

78fd3664ce88f8a51e8fd8280f987f930276f0497f597430b0aeedfde99a40f7

.exe 45KB

78fd3664ce88f8a51e8fd8280f987f930276f0497f597430b0aeedfde99a40f7

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 78fd3664ce88f8a51e8fd8280f987f930276f0497f597430b0aeedfde99a40f7
MD5 f495389699d7227e52a5b3e4d4fa04b2
SHA1 5be945403a39fe1a045c53083673025c4579f674
SHA512 b7438c7335ad3829419ca256a3ac810ea965248b52f7e4080f3d3708b74c08309f9fc98036c2ad873a2dbe2a16fe5a2408cb478cf40c3e6c68253dd6a755a95b
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAu0ewtDc30oiZPI/zjbQgX3iQYHZElHvHbY4PbBDg:cuqNJTLr62gwR2iW/3bXXSQYqlDYsNdW
TLSH
T11B2329003BE9812BF2BE4F7898F26245867AF6633603D5491CC451DB5713FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

78fd3664ce88f8a51e8fd8280f987f930276f0497f597430b0aeedfde99a40f7

mscoree

dotnet