asyncrat | 03495d1573d4582efec76ec54367420a2bb2ceebcb9b51223072b131e3ef167e

Sharing

Copy URL Twitter E-mail

General

Target
03495d1573d4582efec76ec54367420a2bb2ceebcb9b51223072b131e3ef167e
Size 45KB
Sample260803-j8szqaem21
SHA256 03495d1573d4582efec76ec54367420a2bb2ceebcb9b51223072b131e3ef167e
MD5 b967f503cb7750a62bb8350e5597d60e
SHA1 ff710f719e680e451a6c92ee8a29688d9abb9b56
SHA512 26e300d1e795ff4c4dd62056196984da8383478ad1ac983f6acb4d243f898d04c3e2f34fd3a222712b6871d4f1542bec14588c4bf42b612101ecb7a9a7e17d1f
SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrYBz3QKx7PIQvjbUgX3iXBJW5RiZGHfDX7BDZkx:vuogpT7I627V0Qbb7XS/WvF/rtdkx
TLSH
T1B8231A003BE8813BF2BE4FB89CF26145867AF5632603D58D6CC451DB5623BC6DA426F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xcavengon.click:80
xcavengon.click:22
xcavengon.click:8080
xcavengon.click:8880
xcavengon.click:2052
xcavengon.click:2082
xcavengon.click:2086
xcavengon.click:2095
xcavengon.click:443
xcavengon.click:2053
xcavengon.click:2083
xcavengon.click:2087
xcavengon.click:2096
xcavengon.click:8443
www.xcavengon.click:80
www.xcavengon.click:22
www.xcavengon.click:8080
www.xcavengon.click:8880
www.xcavengon.click:2052
www.xcavengon.click:2082
www.xcavengon.click:2086
www.xcavengon.click:2095
www.xcavengon.click:443
www.xcavengon.click:2053
www.xcavengon.click:2083
www.xcavengon.click:2087
www.xcavengon.click:2096
www.xcavengon.click:8443
gozi.xcavengon.click:80
gozi.xcavengon.click:22
gozi.xcavengon.click:8080
gozi.xcavengon.click:8880
gozi.xcavengon.click:2052
gozi.xcavengon.click:2082
gozi.xcavengon.click:2086
gozi.xcavengon.click:2095
gozi.xcavengon.click:443
gozi.xcavengon.click:2053
gozi.xcavengon.click:2083
gozi.xcavengon.click:2087
gozi.xcavengon.click:2096
gozi.xcavengon.click:8443
conficker.xcavengon.click:80
conficker.xcavengon.click:22
conficker.xcavengon.click:8080
conficker.xcavengon.click:8880
conficker.xcavengon.click:2052
conficker.xcavengon.click:2082
conficker.xcavengon.click:2086
conficker.xcavengon.click:2095
conficker.xcavengon.click:443
conficker.xcavengon.click:2053
conficker.xcavengon.click:2083
conficker.xcavengon.click:2087
conficker.xcavengon.click:2096
conficker.xcavengon.click:8443
hacker.xcavengon.click:80
hacker.xcavengon.click:22
hacker.xcavengon.click:8080
hacker.xcavengon.click:8880
hacker.xcavengon.click:2052
hacker.xcavengon.click:2082
hacker.xcavengon.click:2086
hacker.xcavengon.click:2095
hacker.xcavengon.click:443
hacker.xcavengon.click:2053
hacker.xcavengon.click:2083
hacker.xcavengon.click:2087
hacker.xcavengon.click:2096
hacker.xcavengon.click:8443
qakbot.xcavengon.click:80
qakbot.xcavengon.click:22
qakbot.xcavengon.click:8080
qakbot.xcavengon.click:8880
qakbot.xcavengon.click:2052
qakbot.xcavengon.click:2082
qakbot.xcavengon.click:2086
qakbot.xcavengon.click:2095
qakbot.xcavengon.click:443
qakbot.xcavengon.click:2053
qakbot.xcavengon.click:2083
qakbot.xcavengon.click:2087
qakbot.xcavengon.click:2096
qakbot.xcavengon.click:8443

Mutex

vhrdw96s55h2

Attributes

delay
0
install
true
install_file
dudzf45b.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03495d1573d4582efec76ec54367420a2bb2ceebcb9b51223072b131e3ef167e

File Explorer

03495d1573d4582efec76ec54367420a2bb2ceebcb9b51223072b131e3ef167e

.exe 45KB

03495d1573d4582efec76ec54367420a2bb2ceebcb9b51223072b131e3ef167e

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 03495d1573d4582efec76ec54367420a2bb2ceebcb9b51223072b131e3ef167e
MD5 b967f503cb7750a62bb8350e5597d60e
SHA1 ff710f719e680e451a6c92ee8a29688d9abb9b56
SHA512 26e300d1e795ff4c4dd62056196984da8383478ad1ac983f6acb4d243f898d04c3e2f34fd3a222712b6871d4f1542bec14588c4bf42b612101ecb7a9a7e17d1f
SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrYBz3QKx7PIQvjbUgX3iXBJW5RiZGHfDX7BDZkx:vuogpT7I627V0Qbb7XS/WvF/rtdkx
TLSH
T1B8231A003BE8813BF2BE4FB89CF26145867AF5632603D58D6CC451DB5623BC6DA426F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

03495d1573d4582efec76ec54367420a2bb2ceebcb9b51223072b131e3ef167e

mscoree

dotnet