asyncrat | 5d126ce3c354aa7453e76650672235915153d3e54897a45bd920ebe08b73664a

Sharing

Copy URL Twitter E-mail

General

Target
5d126ce3c354aa7453e76650672235915153d3e54897a45bd920ebe08b73664a
Size 45KB
Sample260803-zbkvvabl3v
SHA256 5d126ce3c354aa7453e76650672235915153d3e54897a45bd920ebe08b73664a
MD5 4ed8cf4ba6bb1f909a4a3a71fa70bd3c
SHA1 be06caaed49d5850d1a892971f1090ce29e3e75e
SHA512 f5582210cf0839e75be737fb8eebcdb0370297550e88a6f53b15eec4abf641b5b93ed131f76ff8bf5a9fdca216e1a3d0728869f94945a64e6f5eb2b74493ff58
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAvAo0p54FcPIOzjbrgX3io+CMt9mLe+BDZUx:cuqNJTLr62/ADv4FhO3bUXSrTQdUx
TLSH
T161231A003BE8853BF1BE4F78ACF26146867AF6632603D54A1CC451DB5713BC6D642AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

cliphotnew1.blog:80
cliphotnew1.blog:22
cliphotnew1.blog:8080
cliphotnew1.blog:8880
cliphotnew1.blog:2052
cliphotnew1.blog:2082
cliphotnew1.blog:2086
cliphotnew1.blog:2095
cliphotnew1.blog:443
cliphotnew1.blog:2053
cliphotnew1.blog:2083
cliphotnew1.blog:2087
cliphotnew1.blog:2096
cliphotnew1.blog:8443
www.cliphotnew1.blog:80
www.cliphotnew1.blog:22
www.cliphotnew1.blog:8080
www.cliphotnew1.blog:8880
www.cliphotnew1.blog:2052
www.cliphotnew1.blog:2082
www.cliphotnew1.blog:2086
www.cliphotnew1.blog:2095
www.cliphotnew1.blog:443
www.cliphotnew1.blog:2053
www.cliphotnew1.blog:2083
www.cliphotnew1.blog:2087
www.cliphotnew1.blog:2096
www.cliphotnew1.blog:8443
stuxnet.cliphotnew1.blog:80
stuxnet.cliphotnew1.blog:22
stuxnet.cliphotnew1.blog:8080
stuxnet.cliphotnew1.blog:8880
stuxnet.cliphotnew1.blog:2052
stuxnet.cliphotnew1.blog:2082
stuxnet.cliphotnew1.blog:2086
stuxnet.cliphotnew1.blog:2095
stuxnet.cliphotnew1.blog:443
stuxnet.cliphotnew1.blog:2053
stuxnet.cliphotnew1.blog:2083
stuxnet.cliphotnew1.blog:2087
stuxnet.cliphotnew1.blog:2096
stuxnet.cliphotnew1.blog:8443
iloveyou.cliphotnew1.blog:80
iloveyou.cliphotnew1.blog:22
iloveyou.cliphotnew1.blog:8080
iloveyou.cliphotnew1.blog:8880
iloveyou.cliphotnew1.blog:2052
iloveyou.cliphotnew1.blog:2082
iloveyou.cliphotnew1.blog:2086
iloveyou.cliphotnew1.blog:2095
iloveyou.cliphotnew1.blog:443
iloveyou.cliphotnew1.blog:2053
iloveyou.cliphotnew1.blog:2083
iloveyou.cliphotnew1.blog:2087
iloveyou.cliphotnew1.blog:2096
iloveyou.cliphotnew1.blog:8443
revil.cliphotnew1.blog:80
revil.cliphotnew1.blog:22
revil.cliphotnew1.blog:8080
revil.cliphotnew1.blog:8880
revil.cliphotnew1.blog:2052
revil.cliphotnew1.blog:2082
revil.cliphotnew1.blog:2086
revil.cliphotnew1.blog:2095
revil.cliphotnew1.blog:443
revil.cliphotnew1.blog:2053
revil.cliphotnew1.blog:2083
revil.cliphotnew1.blog:2087
revil.cliphotnew1.blog:2096
revil.cliphotnew1.blog:8443
sodinokibi.cliphotnew1.blog:80
sodinokibi.cliphotnew1.blog:22
sodinokibi.cliphotnew1.blog:8080
sodinokibi.cliphotnew1.blog:8880
sodinokibi.cliphotnew1.blog:2052
sodinokibi.cliphotnew1.blog:2082
sodinokibi.cliphotnew1.blog:2086
sodinokibi.cliphotnew1.blog:2095
sodinokibi.cliphotnew1.blog:443
sodinokibi.cliphotnew1.blog:2053
sodinokibi.cliphotnew1.blog:2083
sodinokibi.cliphotnew1.blog:2087
sodinokibi.cliphotnew1.blog:2096
sodinokibi.cliphotnew1.blog:8443

Mutex

DzFb7UI6goqU

Attributes

delay
0
install
true
install_file
35ny.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d126ce3c354aa7453e76650672235915153d3e54897a45bd920ebe08b73664a

File Explorer

5d126ce3c354aa7453e76650672235915153d3e54897a45bd920ebe08b73664a

.exe 45KB

5d126ce3c354aa7453e76650672235915153d3e54897a45bd920ebe08b73664a

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5d126ce3c354aa7453e76650672235915153d3e54897a45bd920ebe08b73664a
MD5 4ed8cf4ba6bb1f909a4a3a71fa70bd3c
SHA1 be06caaed49d5850d1a892971f1090ce29e3e75e
SHA512 f5582210cf0839e75be737fb8eebcdb0370297550e88a6f53b15eec4abf641b5b93ed131f76ff8bf5a9fdca216e1a3d0728869f94945a64e6f5eb2b74493ff58
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAvAo0p54FcPIOzjbrgX3io+CMt9mLe+BDZUx:cuqNJTLr62/ADv4FhO3bUXSrTQdUx
TLSH
T161231A003BE8853BF1BE4F78ACF26146867AF6632603D54A1CC451DB5713BC6D642AF9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

5d126ce3c354aa7453e76650672235915153d3e54897a45bd920ebe08b73664a

mscoree

dotnet