asyncrat | cda5d96d8945fa0fc6c7dc5b25d407ee4e03162d2a1a76b2455cbff367e27372

Sharing

Copy URL Twitter E-mail

General

Target
cda5d96d8945fa0fc6c7dc5b25d407ee4e03162d2a1a76b2455cbff367e27372
Size 45KB
Sample260803-l7yvpathrg
SHA256 cda5d96d8945fa0fc6c7dc5b25d407ee4e03162d2a1a76b2455cbff367e27372
MD5 c62e491b8711b526c9e02f005cc77c59
SHA1 77296a8a158104304eff9b7f75e22398041008ec
SHA512 4d9975e59a92e1b56f2ae473398ed993f6f63474a64f5f51e9a61ba44517705dce2df30cd53c7013984487fd2e5bc432df954a06a85ff2f623553487102db705
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHy/aKPIb1jb+gX3i/8gJ0UBDZsx:EufspTf2g23nhbdbBXS/Tyidsx
TLSH
T1CB2319003BE9C12BF2BE5F78A9F26145467AB6633A03D6491CC411DB5713FC58A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.top:80
zorvec.top:22
zorvec.top:8080
zorvec.top:8880
zorvec.top:2052
zorvec.top:2082
zorvec.top:2086
zorvec.top:2095
zorvec.top:443
zorvec.top:2053
zorvec.top:2083
zorvec.top:2087
zorvec.top:2096
zorvec.top:8443
www.zorvec.top:80
www.zorvec.top:22
www.zorvec.top:8080
www.zorvec.top:8880
www.zorvec.top:2052
www.zorvec.top:2082
www.zorvec.top:2086
www.zorvec.top:2095
www.zorvec.top:443
www.zorvec.top:2053
www.zorvec.top:2083
www.zorvec.top:2087
www.zorvec.top:2096
www.zorvec.top:8443
socgholish.zorvec.top:80
socgholish.zorvec.top:22
socgholish.zorvec.top:8080
socgholish.zorvec.top:8880
socgholish.zorvec.top:2052
socgholish.zorvec.top:2082
socgholish.zorvec.top:2086
socgholish.zorvec.top:2095
socgholish.zorvec.top:443
socgholish.zorvec.top:2053
socgholish.zorvec.top:2083
socgholish.zorvec.top:2087
socgholish.zorvec.top:2096
socgholish.zorvec.top:8443
revil.zorvec.top:80
revil.zorvec.top:22
revil.zorvec.top:8080
revil.zorvec.top:8880
revil.zorvec.top:2052
revil.zorvec.top:2082
revil.zorvec.top:2086
revil.zorvec.top:2095
revil.zorvec.top:443
revil.zorvec.top:2053
revil.zorvec.top:2083
revil.zorvec.top:2087
revil.zorvec.top:2096
revil.zorvec.top:8443
invasive.zorvec.top:80
invasive.zorvec.top:22
invasive.zorvec.top:8080
invasive.zorvec.top:8880
invasive.zorvec.top:2052
invasive.zorvec.top:2082
invasive.zorvec.top:2086
invasive.zorvec.top:2095
invasive.zorvec.top:443
invasive.zorvec.top:2053
invasive.zorvec.top:2083
invasive.zorvec.top:2087
invasive.zorvec.top:2096
invasive.zorvec.top:8443
connect.zorvec.top:80
connect.zorvec.top:22
connect.zorvec.top:8080
connect.zorvec.top:8880
connect.zorvec.top:2052
connect.zorvec.top:2082
connect.zorvec.top:2086
connect.zorvec.top:2095
connect.zorvec.top:443
connect.zorvec.top:2053
connect.zorvec.top:2083
connect.zorvec.top:2087
connect.zorvec.top:2096
connect.zorvec.top:8443

Mutex

Xn3RUO97ApJR

Attributes

delay
0
install
true
install_file
v5pqq38.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cda5d96d8945fa0fc6c7dc5b25d407ee4e03162d2a1a76b2455cbff367e27372

File Explorer

cda5d96d8945fa0fc6c7dc5b25d407ee4e03162d2a1a76b2455cbff367e27372

.exe 45KB

cda5d96d8945fa0fc6c7dc5b25d407ee4e03162d2a1a76b2455cbff367e27372

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 cda5d96d8945fa0fc6c7dc5b25d407ee4e03162d2a1a76b2455cbff367e27372
MD5 c62e491b8711b526c9e02f005cc77c59
SHA1 77296a8a158104304eff9b7f75e22398041008ec
SHA512 4d9975e59a92e1b56f2ae473398ed993f6f63474a64f5f51e9a61ba44517705dce2df30cd53c7013984487fd2e5bc432df954a06a85ff2f623553487102db705
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHy/aKPIb1jb+gX3i/8gJ0UBDZsx:EufspTf2g23nhbdbBXS/Tyidsx
TLSH
T1CB2319003BE9C12BF2BE5F78A9F26145467AB6633A03D6491CC411DB5713FC58A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

cda5d96d8945fa0fc6c7dc5b25d407ee4e03162d2a1a76b2455cbff367e27372

mscoree

dotnet