asyncrat | e49c51ae768155edf83b8aa5c362d76243ea69deb6d341c8ae934979e9cc3c8d

Sharing

Copy URL Twitter E-mail

General

Target
e49c51ae768155edf83b8aa5c362d76243ea69deb6d341c8ae934979e9cc3c8d
Size 45KB
Sample260724-w9ql7sweph
SHA256 e49c51ae768155edf83b8aa5c362d76243ea69deb6d341c8ae934979e9cc3c8d
MD5 1ade1cd7a9d470d5ce3db9febc3f2119
SHA1 be2fd4cb24bcdb724e3a5a5abdd3d07ed7277275
SHA512 e30566f65dc3e304fe28292fbad30a6f377f406ca2d4938f42af2bb2d89d1735dfb992ba3f9d225ec8942094d2b40a8e458085d0fb1ec0cfde60bc0d607890f4
SSDEEP 768:0uZ8pT1Uu4/cWUeT66mo2q13sD/pneqPIkzjbhgX3ifVrsfKj5xBDZAx:0uZ8pT1tc28sjJeTk3bOXSfVrPdPdAx
TLSH
T173233C0037E8812BF2BE4F78ADF26145867AF2672603D54D1CC451DB5623FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexdamvn.com:80
sexdamvn.com:22
sexdamvn.com:8080
sexdamvn.com:8880
sexdamvn.com:2052
sexdamvn.com:2082
sexdamvn.com:2086
sexdamvn.com:2095
sexdamvn.com:443
sexdamvn.com:2053
sexdamvn.com:2083
sexdamvn.com:2087
sexdamvn.com:2096
sexdamvn.com:8443
www.sexdamvn.com:80
www.sexdamvn.com:22
www.sexdamvn.com:8080
www.sexdamvn.com:8880
www.sexdamvn.com:2052
www.sexdamvn.com:2082
www.sexdamvn.com:2086
www.sexdamvn.com:2095
www.sexdamvn.com:443
www.sexdamvn.com:2053
www.sexdamvn.com:2083
www.sexdamvn.com:2087
www.sexdamvn.com:2096
www.sexdamvn.com:8443
invasive.sexdamvn.com:80
invasive.sexdamvn.com:22
invasive.sexdamvn.com:8080
invasive.sexdamvn.com:8880
invasive.sexdamvn.com:2052
invasive.sexdamvn.com:2082
invasive.sexdamvn.com:2086
invasive.sexdamvn.com:2095
invasive.sexdamvn.com:443
invasive.sexdamvn.com:2053
invasive.sexdamvn.com:2083
invasive.sexdamvn.com:2087
invasive.sexdamvn.com:2096
invasive.sexdamvn.com:8443
industroyer.sexdamvn.com:80
industroyer.sexdamvn.com:22
industroyer.sexdamvn.com:8080
industroyer.sexdamvn.com:8880
industroyer.sexdamvn.com:2052
industroyer.sexdamvn.com:2082
industroyer.sexdamvn.com:2086
industroyer.sexdamvn.com:2095
industroyer.sexdamvn.com:443
industroyer.sexdamvn.com:2053
industroyer.sexdamvn.com:2083
industroyer.sexdamvn.com:2087
industroyer.sexdamvn.com:2096
industroyer.sexdamvn.com:8443

Mutex

gMgHhwKsde6U

Attributes

delay
0
install
true
install_file
xd9v.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e49c51ae768155edf83b8aa5c362d76243ea69deb6d341c8ae934979e9cc3c8d

File Explorer

e49c51ae768155edf83b8aa5c362d76243ea69deb6d341c8ae934979e9cc3c8d

.exe 45KB

e49c51ae768155edf83b8aa5c362d76243ea69deb6d341c8ae934979e9cc3c8d

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e49c51ae768155edf83b8aa5c362d76243ea69deb6d341c8ae934979e9cc3c8d
MD5 1ade1cd7a9d470d5ce3db9febc3f2119
SHA1 be2fd4cb24bcdb724e3a5a5abdd3d07ed7277275
SHA512 e30566f65dc3e304fe28292fbad30a6f377f406ca2d4938f42af2bb2d89d1735dfb992ba3f9d225ec8942094d2b40a8e458085d0fb1ec0cfde60bc0d607890f4
SSDEEP 768:0uZ8pT1Uu4/cWUeT66mo2q13sD/pneqPIkzjbhgX3ifVrsfKj5xBDZAx:0uZ8pT1tc28sjJeTk3bOXSfVrPdPdAx
TLSH
T173233C0037E8812BF2BE4F78ADF26145867AF2672603D54D1CC451DB5623FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e49c51ae768155edf83b8aa5c362d76243ea69deb6d341c8ae934979e9cc3c8d

mscoree

dotnet