asyncrat | 0c892004caa91e75c68c9ce7ad776b3a207b24642e174667a907ccf44a6a9505

Sharing

Copy URL Twitter E-mail

General

Target
0c892004caa91e75c68c9ce7ad776b3a207b24642e174667a907ccf44a6a9505
Size 45KB
Sample260720-rx15ysft3v
SHA256 0c892004caa91e75c68c9ce7ad776b3a207b24642e174667a907ccf44a6a9505
MD5 0ec0e4e801ec5607429ee96104e03393
SHA1 b30beaebd6dab6cae9cc32c01d9730b15804fdbd
SHA512 cb19e7a2529608de6f7a9116eeb930276ec574ea054053c10b91d524f044b7a89edbb8111325b09875a0cf098640e57ebba507e53fd4a6a90d6d0cf5e5221876
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwX3Xo5EayPItzjbUgX3i0LVhILcZ0JnVBDZMx:ku40ZTXEb2zQEabt3b7XSmVhicZo7dMx
TLSH
T197232B003BE8812BF2BE4FB8A8F26145867EF6633603D5591CC451DB5713FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

jikklimokmk125:80
jikklimokmk125:22
jikklimokmk125:8080
jikklimokmk125:8880
jikklimokmk125:2052
jikklimokmk125:2082
jikklimokmk125:2086
jikklimokmk125:2095
jikklimokmk125:443
jikklimokmk125:2053
jikklimokmk125:2083
jikklimokmk125:2087
jikklimokmk125:2096
jikklimokmk125:8443
www.jikklimokmk125:80
www.jikklimokmk125:22
www.jikklimokmk125:8080
www.jikklimokmk125:8880
www.jikklimokmk125:2052
www.jikklimokmk125:2082
www.jikklimokmk125:2086
www.jikklimokmk125:2095
www.jikklimokmk125:443
www.jikklimokmk125:2053
www.jikklimokmk125:2083
www.jikklimokmk125:2087
www.jikklimokmk125:2096
www.jikklimokmk125:8443
nanocore.jikklimokmk125:80
nanocore.jikklimokmk125:22
nanocore.jikklimokmk125:8080
nanocore.jikklimokmk125:8880
nanocore.jikklimokmk125:2052
nanocore.jikklimokmk125:2082
nanocore.jikklimokmk125:2086
nanocore.jikklimokmk125:2095
nanocore.jikklimokmk125:443
nanocore.jikklimokmk125:2053
nanocore.jikklimokmk125:2083
nanocore.jikklimokmk125:2087
nanocore.jikklimokmk125:2096
nanocore.jikklimokmk125:8443
klez.jikklimokmk125:80
klez.jikklimokmk125:22
klez.jikklimokmk125:8080
klez.jikklimokmk125:8880
klez.jikklimokmk125:2052
klez.jikklimokmk125:2082
klez.jikklimokmk125:2086
klez.jikklimokmk125:2095
klez.jikklimokmk125:443
klez.jikklimokmk125:2053
klez.jikklimokmk125:2083
klez.jikklimokmk125:2087
klez.jikklimokmk125:2096
klez.jikklimokmk125:8443
melissa.jikklimokmk125:80
melissa.jikklimokmk125:22
melissa.jikklimokmk125:8080
melissa.jikklimokmk125:8880
melissa.jikklimokmk125:2052
melissa.jikklimokmk125:2082
melissa.jikklimokmk125:2086
melissa.jikklimokmk125:2095
melissa.jikklimokmk125:443
melissa.jikklimokmk125:2053
melissa.jikklimokmk125:2083
melissa.jikklimokmk125:2087
melissa.jikklimokmk125:2096
melissa.jikklimokmk125:8443
gh0st.jikklimokmk125:80
gh0st.jikklimokmk125:22
gh0st.jikklimokmk125:8080
gh0st.jikklimokmk125:8880
gh0st.jikklimokmk125:2052
gh0st.jikklimokmk125:2082
gh0st.jikklimokmk125:2086
gh0st.jikklimokmk125:2095
gh0st.jikklimokmk125:443
gh0st.jikklimokmk125:2053
gh0st.jikklimokmk125:2083
gh0st.jikklimokmk125:2087
gh0st.jikklimokmk125:2096
gh0st.jikklimokmk125:8443

Mutex

KIHPwlMJgYkI

Attributes

delay
0
install
true
install_file
psa71.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c892004caa91e75c68c9ce7ad776b3a207b24642e174667a907ccf44a6a9505

File Explorer

0c892004caa91e75c68c9ce7ad776b3a207b24642e174667a907ccf44a6a9505

.exe 45KB

0c892004caa91e75c68c9ce7ad776b3a207b24642e174667a907ccf44a6a9505

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0c892004caa91e75c68c9ce7ad776b3a207b24642e174667a907ccf44a6a9505
MD5 0ec0e4e801ec5607429ee96104e03393
SHA1 b30beaebd6dab6cae9cc32c01d9730b15804fdbd
SHA512 cb19e7a2529608de6f7a9116eeb930276ec574ea054053c10b91d524f044b7a89edbb8111325b09875a0cf098640e57ebba507e53fd4a6a90d6d0cf5e5221876
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwX3Xo5EayPItzjbUgX3i0LVhILcZ0JnVBDZMx:ku40ZTXEb2zQEabt3b7XSmVhicZo7dMx
TLSH
T197232B003BE8812BF2BE4FB8A8F26145867EF6633603D5591CC451DB5713FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

0c892004caa91e75c68c9ce7ad776b3a207b24642e174667a907ccf44a6a9505

mscoree

dotnet