asyncrat | 849ba2917b8f1b7eed77f5538afc1da69afe4862c73590c7b5d1e26fe1cba12f

Sharing

Copy URL Twitter E-mail

General

Target
849ba2917b8f1b7eed77f5538afc1da69afe4862c73590c7b5d1e26fe1cba12f
Size 45KB
Sample260722-t212vsvyfs
SHA256 849ba2917b8f1b7eed77f5538afc1da69afe4862c73590c7b5d1e26fe1cba12f
MD5 18d8426acafd8a9ccdebfbf1516f734b
SHA1 35862b3de05684456a80f9899090b0837836436e
SHA512 3a8cbce9f6e99c0e92ab346d6cab00ca4366d1bd7c20875f864043d71a6f2066a9876f54b4012ca5075d30e19b756e46785af25be4e6be78b8404b1a0fec8a15
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3xY6aZOOPIgzjb7ga3iN+XzPaIoEbeBBDZUx:cu7e5TH2A2ku/O3g3bEaSNuzSnce/dUx
TLSH
T18C232B003FED822BF2BE4F7499F26105457AF5B32603D54A1CC4529B5A23FC696426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sex18.tech:80
sex18.tech:22
sex18.tech:8080
sex18.tech:8880
sex18.tech:2052
sex18.tech:2082
sex18.tech:2086
sex18.tech:2095
sex18.tech:443
sex18.tech:2053
sex18.tech:2083
sex18.tech:2087
sex18.tech:2096
sex18.tech:8443
www.sex18.tech:80
www.sex18.tech:22
www.sex18.tech:8080
www.sex18.tech:8880
www.sex18.tech:2052
www.sex18.tech:2082
www.sex18.tech:2086
www.sex18.tech:2095
www.sex18.tech:443
www.sex18.tech:2053
www.sex18.tech:2083
www.sex18.tech:2087
www.sex18.tech:2096
www.sex18.tech:8443
invasive.sex18.tech:80
invasive.sex18.tech:22
invasive.sex18.tech:8080
invasive.sex18.tech:8880
invasive.sex18.tech:2052
invasive.sex18.tech:2082
invasive.sex18.tech:2086
invasive.sex18.tech:2095
invasive.sex18.tech:443
invasive.sex18.tech:2053
invasive.sex18.tech:2083
invasive.sex18.tech:2087
invasive.sex18.tech:2096
invasive.sex18.tech:8443
hack.sex18.tech:80
hack.sex18.tech:22
hack.sex18.tech:8080
hack.sex18.tech:8880
hack.sex18.tech:2052
hack.sex18.tech:2082
hack.sex18.tech:2086
hack.sex18.tech:2095
hack.sex18.tech:443
hack.sex18.tech:2053
hack.sex18.tech:2083
hack.sex18.tech:2087
hack.sex18.tech:2096
hack.sex18.tech:8443
stuxnet.sex18.tech:80
stuxnet.sex18.tech:22
stuxnet.sex18.tech:8080
stuxnet.sex18.tech:8880
stuxnet.sex18.tech:2052
stuxnet.sex18.tech:2082
stuxnet.sex18.tech:2086
stuxnet.sex18.tech:2095
stuxnet.sex18.tech:443
stuxnet.sex18.tech:2053
stuxnet.sex18.tech:2083
stuxnet.sex18.tech:2087
stuxnet.sex18.tech:2096
stuxnet.sex18.tech:8443

Mutex

d8ktPC76cLkD

Attributes

delay
0
install
true
install_file
da15j.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
849ba2917b8f1b7eed77f5538afc1da69afe4862c73590c7b5d1e26fe1cba12f

File Explorer

849ba2917b8f1b7eed77f5538afc1da69afe4862c73590c7b5d1e26fe1cba12f

.exe 45KB

849ba2917b8f1b7eed77f5538afc1da69afe4862c73590c7b5d1e26fe1cba12f

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 849ba2917b8f1b7eed77f5538afc1da69afe4862c73590c7b5d1e26fe1cba12f
MD5 18d8426acafd8a9ccdebfbf1516f734b
SHA1 35862b3de05684456a80f9899090b0837836436e
SHA512 3a8cbce9f6e99c0e92ab346d6cab00ca4366d1bd7c20875f864043d71a6f2066a9876f54b4012ca5075d30e19b756e46785af25be4e6be78b8404b1a0fec8a15
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3xY6aZOOPIgzjb7ga3iN+XzPaIoEbeBBDZUx:cu7e5TH2A2ku/O3g3bEaSNuzSnce/dUx
TLSH
T18C232B003FED822BF2BE4F7499F26105457AF5B32603D54A1CC4529B5A23FC696426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

849ba2917b8f1b7eed77f5538afc1da69afe4862c73590c7b5d1e26fe1cba12f

mscoree

dotnet