asyncrat | 91172197c904bac7274afcbbb83845fd129b51e290ede1c3c62d28380dac8293

Sharing

Copy URL Twitter E-mail

General

Target
91172197c904bac7274afcbbb83845fd129b51e290ede1c3c62d28380dac8293
Size 45KB
Sample260722-lv39msgk4s
SHA256 91172197c904bac7274afcbbb83845fd129b51e290ede1c3c62d28380dac8293
MD5 904061408e8adb640c7cb710125a09a0
SHA1 028d097c42eca8e3151279740ffb968f46df16da
SHA512 1d096597f1117d9a9beb0c98ef84f7c0b7face824373e21040c316e6c169b866a81c06c1c1aa4b5a8984a7dba6a1b065a6f6194a0d0ec82e8a3ee8566caa733d
SSDEEP 768:4uBfJTMUyYUWUWBDimo2qV98V1RpYEcPIazjbkgX3iqcNpl1BuSKPBDZbx:4uBfJTMpv2O8VDeEha3brXSRNpRu/dbx
TLSH
T185232C103BE9823BF2BE4FB89CF26145867AF6633602D64D1CC451DB5613BC68642AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sex18.tech:80
sex18.tech:22
sex18.tech:8080
sex18.tech:8880
sex18.tech:2052
sex18.tech:2082
sex18.tech:2086
sex18.tech:2095
sex18.tech:443
sex18.tech:2053
sex18.tech:2083
sex18.tech:2087
sex18.tech:2096
sex18.tech:8443
www.sex18.tech:80
www.sex18.tech:22
www.sex18.tech:8080
www.sex18.tech:8880
www.sex18.tech:2052
www.sex18.tech:2082
www.sex18.tech:2086
www.sex18.tech:2095
www.sex18.tech:443
www.sex18.tech:2053
www.sex18.tech:2083
www.sex18.tech:2087
www.sex18.tech:2096
www.sex18.tech:8443
darkside.sex18.tech:80
darkside.sex18.tech:22
darkside.sex18.tech:8080
darkside.sex18.tech:8880
darkside.sex18.tech:2052
darkside.sex18.tech:2082
darkside.sex18.tech:2086
darkside.sex18.tech:2095
darkside.sex18.tech:443
darkside.sex18.tech:2053
darkside.sex18.tech:2083
darkside.sex18.tech:2087
darkside.sex18.tech:2096
darkside.sex18.tech:8443
sasser.sex18.tech:80
sasser.sex18.tech:22
sasser.sex18.tech:8080
sasser.sex18.tech:8880
sasser.sex18.tech:2052
sasser.sex18.tech:2082
sasser.sex18.tech:2086
sasser.sex18.tech:2095
sasser.sex18.tech:443
sasser.sex18.tech:2053
sasser.sex18.tech:2083
sasser.sex18.tech:2087
sasser.sex18.tech:2096
sasser.sex18.tech:8443

Mutex

Wh4oTfFZcxzW

Attributes

delay
0
install
true
install_file
vf5w.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
91172197c904bac7274afcbbb83845fd129b51e290ede1c3c62d28380dac8293

File Explorer

91172197c904bac7274afcbbb83845fd129b51e290ede1c3c62d28380dac8293

.exe 45KB

91172197c904bac7274afcbbb83845fd129b51e290ede1c3c62d28380dac8293

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 91172197c904bac7274afcbbb83845fd129b51e290ede1c3c62d28380dac8293
MD5 904061408e8adb640c7cb710125a09a0
SHA1 028d097c42eca8e3151279740ffb968f46df16da
SHA512 1d096597f1117d9a9beb0c98ef84f7c0b7face824373e21040c316e6c169b866a81c06c1c1aa4b5a8984a7dba6a1b065a6f6194a0d0ec82e8a3ee8566caa733d
SSDEEP 768:4uBfJTMUyYUWUWBDimo2qV98V1RpYEcPIazjbkgX3iqcNpl1BuSKPBDZbx:4uBfJTMpv2O8VDeEha3brXSRNpRu/dbx
TLSH
T185232C103BE9823BF2BE4FB89CF26145867AF6633602D64D1CC451DB5613BC68642AFD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

91172197c904bac7274afcbbb83845fd129b51e290ede1c3c62d28380dac8293

mscoree

dotnet