asyncrat | faf0b7d52ae09dd29d4de949fe77ba535c713df117c72e5d54d63f8eca005162

Sharing

Copy URL Twitter E-mail

General

Target
faf0b7d52ae09dd29d4de949fe77ba535c713df117c72e5d54d63f8eca005162
Size 45KB
Sample260721-vb7mdscf95
SHA256 faf0b7d52ae09dd29d4de949fe77ba535c713df117c72e5d54d63f8eca005162
MD5 c1979339df4e5cad01e0b8d0560f8bbf
SHA1 688ad665825ecbea206974c5d7e6793f21646319
SHA512 cc251bdd7edec3f84b6953c6b946267981065f0e7d97d23a96722ebb301990ce87186dc5b7e6f66fd6a73a863b6c0c29a0183084464e4db91f47535c55a44208
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q19/D0CCMAR4np78PIcijb/gX3iyjZzSpf8nGWh7BDZW:cuR0JTPjY2kTCzwBcubIXSyJ48jtdUx
TLSH
T194231A003BE8812BF2BE4F78A9F26145867AB5632A03D54E1C8451DB5623FC696436FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sex18.tech:80
sex18.tech:22
sex18.tech:8080
sex18.tech:8880
sex18.tech:2052
sex18.tech:2082
sex18.tech:2086
sex18.tech:2095
sex18.tech:443
sex18.tech:2053
sex18.tech:2083
sex18.tech:2087
sex18.tech:2096
sex18.tech:8443
www.sex18.tech:80
www.sex18.tech:22
www.sex18.tech:8080
www.sex18.tech:8880
www.sex18.tech:2052
www.sex18.tech:2082
www.sex18.tech:2086
www.sex18.tech:2095
www.sex18.tech:443
www.sex18.tech:2053
www.sex18.tech:2083
www.sex18.tech:2087
www.sex18.tech:2096
www.sex18.tech:8443
shamoon.sex18.tech:80
shamoon.sex18.tech:22
shamoon.sex18.tech:8080
shamoon.sex18.tech:8880
shamoon.sex18.tech:2052
shamoon.sex18.tech:2082
shamoon.sex18.tech:2086
shamoon.sex18.tech:2095
shamoon.sex18.tech:443
shamoon.sex18.tech:2053
shamoon.sex18.tech:2083
shamoon.sex18.tech:2087
shamoon.sex18.tech:2096
shamoon.sex18.tech:8443
agenttesla.sex18.tech:80
agenttesla.sex18.tech:22
agenttesla.sex18.tech:8080
agenttesla.sex18.tech:8880
agenttesla.sex18.tech:2052
agenttesla.sex18.tech:2082
agenttesla.sex18.tech:2086
agenttesla.sex18.tech:2095
agenttesla.sex18.tech:443
agenttesla.sex18.tech:2053
agenttesla.sex18.tech:2083
agenttesla.sex18.tech:2087
agenttesla.sex18.tech:2096
agenttesla.sex18.tech:8443
notpetya.sex18.tech:80
notpetya.sex18.tech:22
notpetya.sex18.tech:8080
notpetya.sex18.tech:8880
notpetya.sex18.tech:2052
notpetya.sex18.tech:2082
notpetya.sex18.tech:2086
notpetya.sex18.tech:2095
notpetya.sex18.tech:443
notpetya.sex18.tech:2053
notpetya.sex18.tech:2083
notpetya.sex18.tech:2087
notpetya.sex18.tech:2096
notpetya.sex18.tech:8443

Mutex

9pWILTMtlFYr

Attributes

delay
0
install
true
install_file
c6hd.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
faf0b7d52ae09dd29d4de949fe77ba535c713df117c72e5d54d63f8eca005162

File Explorer

faf0b7d52ae09dd29d4de949fe77ba535c713df117c72e5d54d63f8eca005162

.exe 45KB

faf0b7d52ae09dd29d4de949fe77ba535c713df117c72e5d54d63f8eca005162

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 faf0b7d52ae09dd29d4de949fe77ba535c713df117c72e5d54d63f8eca005162
MD5 c1979339df4e5cad01e0b8d0560f8bbf
SHA1 688ad665825ecbea206974c5d7e6793f21646319
SHA512 cc251bdd7edec3f84b6953c6b946267981065f0e7d97d23a96722ebb301990ce87186dc5b7e6f66fd6a73a863b6c0c29a0183084464e4db91f47535c55a44208
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q19/D0CCMAR4np78PIcijb/gX3iyjZzSpf8nGWh7BDZW:cuR0JTPjY2kTCzwBcubIXSyJ48jtdUx
TLSH
T194231A003BE8812BF2BE4F78A9F26145867AB5632A03D54E1C8451DB5623FC696436FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

faf0b7d52ae09dd29d4de949fe77ba535c713df117c72e5d54d63f8eca005162

mscoree

dotnet