asyncrat | 501d71a684b1a091e9134160e33d2b19eecc1f070f9fd5731f13cb1b3c02bcff

Sharing

Copy URL Twitter E-mail

General

Target
501d71a684b1a091e9134160e33d2b19eecc1f070f9fd5731f13cb1b3c02bcff
Size 45KB
Sample260803-pq9gmsbj21
SHA256 501d71a684b1a091e9134160e33d2b19eecc1f070f9fd5731f13cb1b3c02bcff
MD5 c3212a036eb9c3c15c1fdb6adb897a3b
SHA1 4765001939eea64dab57e0f94635fbd3a1eb353c
SHA512 33e2f0235e4a35abb03268a63ccb42ffbd8d39e67dee605709a238f1a57758073a0610f405509f6de985a0642a199374d2d726ec8d44d769d149dd4c99e8b0de
SSDEEP 768:4uBGJTP0BQ0UWUWHaimo2qVzsD/pneqPIkzjbJgX3iJ/BxnABgfbIGTxZBDZ4x:4uBGJTPho2QsjJeTk3bGXSJf/xTxHd4x
TLSH
T13D232B003BE8862BF2BE4F78ADF26145867AF2633603D5492CC4519B5613FC6C652AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sas-cdn.com:80
sas-cdn.com:22
sas-cdn.com:8080
sas-cdn.com:8880
sas-cdn.com:2052
sas-cdn.com:2082
sas-cdn.com:2086
sas-cdn.com:2095
sas-cdn.com:443
sas-cdn.com:2053
sas-cdn.com:2083
sas-cdn.com:2087
sas-cdn.com:2096
sas-cdn.com:8443
www.sas-cdn.com:80
www.sas-cdn.com:22
www.sas-cdn.com:8080
www.sas-cdn.com:8880
www.sas-cdn.com:2052
www.sas-cdn.com:2082
www.sas-cdn.com:2086
www.sas-cdn.com:2095
www.sas-cdn.com:443
www.sas-cdn.com:2053
www.sas-cdn.com:2083
www.sas-cdn.com:2087
www.sas-cdn.com:2096
www.sas-cdn.com:8443
wannacry.sas-cdn.com:80
wannacry.sas-cdn.com:22
wannacry.sas-cdn.com:8080
wannacry.sas-cdn.com:8880
wannacry.sas-cdn.com:2052
wannacry.sas-cdn.com:2082
wannacry.sas-cdn.com:2086
wannacry.sas-cdn.com:2095
wannacry.sas-cdn.com:443
wannacry.sas-cdn.com:2053
wannacry.sas-cdn.com:2083
wannacry.sas-cdn.com:2087
wannacry.sas-cdn.com:2096
wannacry.sas-cdn.com:8443
klez.sas-cdn.com:80
klez.sas-cdn.com:22
klez.sas-cdn.com:8080
klez.sas-cdn.com:8880
klez.sas-cdn.com:2052
klez.sas-cdn.com:2082
klez.sas-cdn.com:2086
klez.sas-cdn.com:2095
klez.sas-cdn.com:443
klez.sas-cdn.com:2053
klez.sas-cdn.com:2083
klez.sas-cdn.com:2087
klez.sas-cdn.com:2096
klez.sas-cdn.com:8443
gozi.sas-cdn.com:80
gozi.sas-cdn.com:22
gozi.sas-cdn.com:8080
gozi.sas-cdn.com:8880
gozi.sas-cdn.com:2052
gozi.sas-cdn.com:2082
gozi.sas-cdn.com:2086
gozi.sas-cdn.com:2095
gozi.sas-cdn.com:443
gozi.sas-cdn.com:2053
gozi.sas-cdn.com:2083
gozi.sas-cdn.com:2087
gozi.sas-cdn.com:2096
gozi.sas-cdn.com:8443
locky.sas-cdn.com:80
locky.sas-cdn.com:22
locky.sas-cdn.com:8080
locky.sas-cdn.com:8880
locky.sas-cdn.com:2052
locky.sas-cdn.com:2082
locky.sas-cdn.com:2086
locky.sas-cdn.com:2095
locky.sas-cdn.com:443
locky.sas-cdn.com:2053
locky.sas-cdn.com:2083
locky.sas-cdn.com:2087
locky.sas-cdn.com:2096
locky.sas-cdn.com:8443

Mutex

9uEjZkzAn5tq

Attributes

delay
0
install
true
install_file
9bfv.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
501d71a684b1a091e9134160e33d2b19eecc1f070f9fd5731f13cb1b3c02bcff

File Explorer

501d71a684b1a091e9134160e33d2b19eecc1f070f9fd5731f13cb1b3c02bcff

.exe 45KB

501d71a684b1a091e9134160e33d2b19eecc1f070f9fd5731f13cb1b3c02bcff

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 501d71a684b1a091e9134160e33d2b19eecc1f070f9fd5731f13cb1b3c02bcff
MD5 c3212a036eb9c3c15c1fdb6adb897a3b
SHA1 4765001939eea64dab57e0f94635fbd3a1eb353c
SHA512 33e2f0235e4a35abb03268a63ccb42ffbd8d39e67dee605709a238f1a57758073a0610f405509f6de985a0642a199374d2d726ec8d44d769d149dd4c99e8b0de
SSDEEP 768:4uBGJTP0BQ0UWUWHaimo2qVzsD/pneqPIkzjbJgX3iJ/BxnABgfbIGTxZBDZ4x:4uBGJTPho2QsjJeTk3bGXSJf/xTxHd4x
TLSH
T13D232B003BE8862BF2BE4F78ADF26145867AF2633603D5492CC4519B5613FC6C652AFD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

501d71a684b1a091e9134160e33d2b19eecc1f070f9fd5731f13cb1b3c02bcff

mscoree

dotnet