asyncrat | AsyncClient[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AsyncClient.exe
Size 45KB
Sample260801-e5lzsadf73
SHA256 459fa536e159dc17b55a78c94dfe750b7452aea6d22333aa0c52477e499a0126
MD5 a612879a18f00dc40c4f9c344d81ff9b
SHA1 12d9f41e128477c5b514723923046847e79aea35
SHA512 fa2e96295ba1b6f9e27d88b6f3c53a4ab790d3d505be38e9d2fded816e17f51eee1a8a9d775b52c4c5ef4051458e03208791be75dc9b9533c0607e60839d11b0
SSDEEP 768:zullRTc4YFgWUKRVpmo2qjCOjPGagAWOzjbFgX3i8VhyfL17s/ucDZxf+:zullRTc3J2bOTKTO3bCXSP17s/Rdxf+
TLSH
T14B232A003BE9812BF2BE4FB898F26145467AF6636603D64E1CC441DB5B13FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cmec.in/vi-vn/:6606
cmec.in/vi-vn/:7707
cmec.in/vi-vn/:8808
cmec.in/vi-vn/:443
cmec.in/vi-vn/:80
cmec.in/vi-vn/:8844
cmec.in/vi-vn/:22
cmec.in/vi-vn/:53
ee88.codes/vi-vn/:6606
ee88.codes/vi-vn/:7707
ee88.codes/vi-vn/:8808
ee88.codes/vi-vn/:443
ee88.codes/vi-vn/:80
ee88.codes/vi-vn/:8844
ee88.codes/vi-vn/:22
ee88.codes/vi-vn/:53
installatiebedrijfahdejong.nl/vi-vn/:6606
installatiebedrijfahdejong.nl/vi-vn/:7707
installatiebedrijfahdejong.nl/vi-vn/:8808
installatiebedrijfahdejong.nl/vi-vn/:443
installatiebedrijfahdejong.nl/vi-vn/:80
installatiebedrijfahdejong.nl/vi-vn/:8844
installatiebedrijfahdejong.nl/vi-vn/:22
installatiebedrijfahdejong.nl/vi-vn/:53
serialz.nl/vi-vn/:6606
serialz.nl/vi-vn/:7707
serialz.nl/vi-vn/:8808
serialz.nl/vi-vn/:443
serialz.nl/vi-vn/:80
serialz.nl/vi-vn/:8844
serialz.nl/vi-vn/:22
serialz.nl/vi-vn/:53
rajajackpot.jp.net/vi-vn/:6606
rajajackpot.jp.net/vi-vn/:7707
rajajackpot.jp.net/vi-vn/:8808
rajajackpot.jp.net/vi-vn/:443
rajajackpot.jp.net/vi-vn/:80
rajajackpot.jp.net/vi-vn/:8844
rajajackpot.jp.net/vi-vn/:22
rajajackpot.jp.net/vi-vn/:53
rbtech.it.com/:6606
rbtech.it.com/:7707
rbtech.it.com/:8808
rbtech.it.com/:443
rbtech.it.com/:80
rbtech.it.com/:8844
rbtech.it.com/:22
rbtech.it.com/:53
onepiece-consideration.com/vi-vn/:6606
onepiece-consideration.com/vi-vn/:7707
onepiece-consideration.com/vi-vn/:8808
onepiece-consideration.com/vi-vn/:443
onepiece-consideration.com/vi-vn/:80
onepiece-consideration.com/vi-vn/:8844
onepiece-consideration.com/vi-vn/:22
onepiece-consideration.com/vi-vn/:53
dcell.co.in/:6606
dcell.co.in/:7707
dcell.co.in/:8808
dcell.co.in/:443
dcell.co.in/:80
dcell.co.in/:8844
dcell.co.in/:22
dcell.co.in/:53
colorwiz.in/vi-vn/:6606
colorwiz.in/vi-vn/:7707
colorwiz.in/vi-vn/:8808
colorwiz.in/vi-vn/:443
colorwiz.in/vi-vn/:80
colorwiz.in/vi-vn/:8844
colorwiz.in/vi-vn/:22
colorwiz.in/vi-vn/:53

Mutex

4UWs9OPJ8vyg

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AsyncClient.exe

File Explorer

AsyncClient.exe

.exe 45KB

AsyncClient.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 459fa536e159dc17b55a78c94dfe750b7452aea6d22333aa0c52477e499a0126
MD5 a612879a18f00dc40c4f9c344d81ff9b
SHA1 12d9f41e128477c5b514723923046847e79aea35
SHA512 fa2e96295ba1b6f9e27d88b6f3c53a4ab790d3d505be38e9d2fded816e17f51eee1a8a9d775b52c4c5ef4051458e03208791be75dc9b9533c0607e60839d11b0
SSDEEP 768:zullRTc4YFgWUKRVpmo2qjCOjPGagAWOzjbFgX3i8VhyfL17s/ucDZxf+:zullRTc3J2bOTKTO3bCXSP17s/Rdxf+
TLSH
T14B232A003BE9812BF2BE4FB898F26145467AF6636603D64E1CC441DB5B13FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

AsyncClient.exe

mscoree

dotnet