asyncrat | b18cab6e119a7dc0dd2fe56472ec72b6a22e422d04cc0b3c7fa37abec1ff1dc6

Sharing

Copy URL Twitter E-mail

General

Target
b18cab6e119a7dc0dd2fe56472ec72b6a22e422d04cc0b3c7fa37abec1ff1dc6
Size 45KB
Sample260802-vwbepaxemb
SHA256 b18cab6e119a7dc0dd2fe56472ec72b6a22e422d04cc0b3c7fa37abec1ff1dc6
MD5 bf8d423e8ef48aee463aa6b5d5d9a184
SHA1 863782f133f8635e1c97e60c4faf354c3a60b78d
SHA512 7d72bb3903b7a0fb8abf992672a54a5130ca10fbede4c25d0ac206177ccdc9589a5a0418bb3d60bbc1e3f82b038860019c6c6d8828e6e47ba181baab3a3813af
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9LK1YJBOPIxq7zjbggH3ivCKXK2SyHSyyyNBDZsx:EulCJTHl42riz3xS3bHHSvCK6FGyyDdu
TLSH
T1FD23190037E8812BF2BE5F78A9F26145867EF6673603D58E1CC451DB4613FC68A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sextin.org:80
sextin.org:22
sextin.org:8080
sextin.org:8880
sextin.org:2052
sextin.org:2082
sextin.org:2086
sextin.org:2095
sextin.org:443
sextin.org:2053
sextin.org:2083
sextin.org:2087
sextin.org:2096
sextin.org:8443
www.sextin.org:80
www.sextin.org:22
www.sextin.org:8080
www.sextin.org:8880
www.sextin.org:2052
www.sextin.org:2082
www.sextin.org:2086
www.sextin.org:2095
www.sextin.org:443
www.sextin.org:2053
www.sextin.org:2083
www.sextin.org:2087
www.sextin.org:2096
www.sextin.org:8443
gh0st.sextin.org:80
gh0st.sextin.org:22
gh0st.sextin.org:8080
gh0st.sextin.org:8880
gh0st.sextin.org:2052
gh0st.sextin.org:2082
gh0st.sextin.org:2086
gh0st.sextin.org:2095
gh0st.sextin.org:443
gh0st.sextin.org:2053
gh0st.sextin.org:2083
gh0st.sextin.org:2087
gh0st.sextin.org:2096
gh0st.sextin.org:8443
hermeticwiper.sextin.org:80
hermeticwiper.sextin.org:22
hermeticwiper.sextin.org:8080
hermeticwiper.sextin.org:8880
hermeticwiper.sextin.org:2052
hermeticwiper.sextin.org:2082
hermeticwiper.sextin.org:2086
hermeticwiper.sextin.org:2095
hermeticwiper.sextin.org:443
hermeticwiper.sextin.org:2053
hermeticwiper.sextin.org:2083
hermeticwiper.sextin.org:2087
hermeticwiper.sextin.org:2096
hermeticwiper.sextin.org:8443
mydoom.sextin.org:80
mydoom.sextin.org:22
mydoom.sextin.org:8080
mydoom.sextin.org:8880
mydoom.sextin.org:2052
mydoom.sextin.org:2082
mydoom.sextin.org:2086
mydoom.sextin.org:2095
mydoom.sextin.org:443
mydoom.sextin.org:2053
mydoom.sextin.org:2083
mydoom.sextin.org:2087
mydoom.sextin.org:2096
mydoom.sextin.org:8443
conti.sextin.org:80
conti.sextin.org:22
conti.sextin.org:8080
conti.sextin.org:8880
conti.sextin.org:2052
conti.sextin.org:2082
conti.sextin.org:2086
conti.sextin.org:2095
conti.sextin.org:443
conti.sextin.org:2053
conti.sextin.org:2083
conti.sextin.org:2087
conti.sextin.org:2096
conti.sextin.org:8443

Mutex

ufRs79Bh2C3a

Attributes

delay
0
install
true
install_file
uhz66m.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b18cab6e119a7dc0dd2fe56472ec72b6a22e422d04cc0b3c7fa37abec1ff1dc6

File Explorer

b18cab6e119a7dc0dd2fe56472ec72b6a22e422d04cc0b3c7fa37abec1ff1dc6

.exe 45KB

b18cab6e119a7dc0dd2fe56472ec72b6a22e422d04cc0b3c7fa37abec1ff1dc6

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b18cab6e119a7dc0dd2fe56472ec72b6a22e422d04cc0b3c7fa37abec1ff1dc6
MD5 bf8d423e8ef48aee463aa6b5d5d9a184
SHA1 863782f133f8635e1c97e60c4faf354c3a60b78d
SHA512 7d72bb3903b7a0fb8abf992672a54a5130ca10fbede4c25d0ac206177ccdc9589a5a0418bb3d60bbc1e3f82b038860019c6c6d8828e6e47ba181baab3a3813af
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9LK1YJBOPIxq7zjbggH3ivCKXK2SyHSyyyNBDZsx:EulCJTHl42riz3xS3bHHSvCK6FGyyDdu
TLSH
T1FD23190037E8812BF2BE5F78A9F26145867EF6673603D58E1CC451DB4613FC68A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

b18cab6e119a7dc0dd2fe56472ec72b6a22e422d04cc0b3c7fa37abec1ff1dc6

mscoree

dotnet