asyncrat | 18a4c1e03c673b67fa063f7cfb04c114190fb4220db85334d1f91bd987af0f59

Sharing

Copy URL Twitter E-mail

General

Target
18a4c1e03c673b67fa063f7cfb04c114190fb4220db85334d1f91bd987af0f59
Size 45KB
Sample260802-graeyaea64
SHA256 18a4c1e03c673b67fa063f7cfb04c114190fb4220db85334d1f91bd987af0f59
MD5 9aa9324b5ad5b8d56c0ac14be6be7bbb
SHA1 0d27c743d286559992cb56166f32f35bb763f090
SHA512 bb76878356807631f27644f4879b3b34d9c3bad14589c76d3f91263040ac1b7fb520877cfe057164d822f4b867988ab0d9ff89373a3f66f39ac31aa148ee58a6
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4T9YikqHztOPIUzjbTgM3i7OZ7sGLnsr8BDZ0x:8uUIpT4vAj2XalK3U3bMMSqZ7sGIrad2
TLSH
T126232A0037E9C12BF2BE4F78A9F26105467AF6633603D64A1CC451DB5623FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xemsexmy.org:80
xemsexmy.org:22
xemsexmy.org:8080
xemsexmy.org:8880
xemsexmy.org:2052
xemsexmy.org:2082
xemsexmy.org:2086
xemsexmy.org:2095
xemsexmy.org:443
xemsexmy.org:2053
xemsexmy.org:2083
xemsexmy.org:2087
xemsexmy.org:2096
xemsexmy.org:8443
www.xemsexmy.org:80
www.xemsexmy.org:22
www.xemsexmy.org:8080
www.xemsexmy.org:8880
www.xemsexmy.org:2052
www.xemsexmy.org:2082
www.xemsexmy.org:2086
www.xemsexmy.org:2095
www.xemsexmy.org:443
www.xemsexmy.org:2053
www.xemsexmy.org:2083
www.xemsexmy.org:2087
www.xemsexmy.org:2096
www.xemsexmy.org:8443
gootloader.xemsexmy.org:80
gootloader.xemsexmy.org:22
gootloader.xemsexmy.org:8080
gootloader.xemsexmy.org:8880
gootloader.xemsexmy.org:2052
gootloader.xemsexmy.org:2082
gootloader.xemsexmy.org:2086
gootloader.xemsexmy.org:2095
gootloader.xemsexmy.org:443
gootloader.xemsexmy.org:2053
gootloader.xemsexmy.org:2083
gootloader.xemsexmy.org:2087
gootloader.xemsexmy.org:2096
gootloader.xemsexmy.org:8443
lokibot.xemsexmy.org:80
lokibot.xemsexmy.org:22
lokibot.xemsexmy.org:8080
lokibot.xemsexmy.org:8880
lokibot.xemsexmy.org:2052
lokibot.xemsexmy.org:2082
lokibot.xemsexmy.org:2086
lokibot.xemsexmy.org:2095
lokibot.xemsexmy.org:443
lokibot.xemsexmy.org:2053
lokibot.xemsexmy.org:2083
lokibot.xemsexmy.org:2087
lokibot.xemsexmy.org:2096
lokibot.xemsexmy.org:8443
qakbot.xemsexmy.org:80
qakbot.xemsexmy.org:22
qakbot.xemsexmy.org:8080
qakbot.xemsexmy.org:8880
qakbot.xemsexmy.org:2052
qakbot.xemsexmy.org:2082
qakbot.xemsexmy.org:2086
qakbot.xemsexmy.org:2095
qakbot.xemsexmy.org:443
qakbot.xemsexmy.org:2053
qakbot.xemsexmy.org:2083
qakbot.xemsexmy.org:2087
qakbot.xemsexmy.org:2096
qakbot.xemsexmy.org:8443
hermeticwiper.xemsexmy.org:80
hermeticwiper.xemsexmy.org:22
hermeticwiper.xemsexmy.org:8080
hermeticwiper.xemsexmy.org:8880
hermeticwiper.xemsexmy.org:2052
hermeticwiper.xemsexmy.org:2082
hermeticwiper.xemsexmy.org:2086
hermeticwiper.xemsexmy.org:2095
hermeticwiper.xemsexmy.org:443
hermeticwiper.xemsexmy.org:2053
hermeticwiper.xemsexmy.org:2083
hermeticwiper.xemsexmy.org:2087
hermeticwiper.xemsexmy.org:2096
hermeticwiper.xemsexmy.org:8443

Mutex

rFYXJ0UbBGE3

Attributes

delay
0
install
true
install_file
mgbafdh.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18a4c1e03c673b67fa063f7cfb04c114190fb4220db85334d1f91bd987af0f59

File Explorer

18a4c1e03c673b67fa063f7cfb04c114190fb4220db85334d1f91bd987af0f59

.exe 45KB

18a4c1e03c673b67fa063f7cfb04c114190fb4220db85334d1f91bd987af0f59

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 18a4c1e03c673b67fa063f7cfb04c114190fb4220db85334d1f91bd987af0f59
MD5 9aa9324b5ad5b8d56c0ac14be6be7bbb
SHA1 0d27c743d286559992cb56166f32f35bb763f090
SHA512 bb76878356807631f27644f4879b3b34d9c3bad14589c76d3f91263040ac1b7fb520877cfe057164d822f4b867988ab0d9ff89373a3f66f39ac31aa148ee58a6
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4T9YikqHztOPIUzjbTgM3i7OZ7sGLnsr8BDZ0x:8uUIpT4vAj2XalK3U3bMMSqZ7sGIrad2
TLSH
T126232A0037E9C12BF2BE4F78A9F26105467AF6633603D64A1CC451DB5623FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

18a4c1e03c673b67fa063f7cfb04c114190fb4220db85334d1f91bd987af0f59

mscoree

dotnet