asyncrat | eefbe7902fa8bd8df076552b7ef6ec446a663711147dddff8fe528b16d4dfc85

Sharing

Copy URL Twitter E-mail

General

Target
eefbe7902fa8bd8df076552b7ef6ec446a663711147dddff8fe528b16d4dfc85
Size 45KB
Sample260804-1z8ggseq6w
SHA256 eefbe7902fa8bd8df076552b7ef6ec446a663711147dddff8fe528b16d4dfc85
MD5 8620c73efccda6ee5772c83648f7a969
SHA1 0e1443ec60253b2a40d22c0957d06aeefb2d92d8
SHA512 86b22998d1e6c313dc16178406a0209c031cc935b2b204e3830447659ce1736d9b61c3746594637f84f33fe048bcfc05687a32e1041e29437fd3fea5b8f38375
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF4ZTohEaSPIVzjbKgX3iCMCQdJkABDZUx:cu7e5TH2A214Ea7V3bdXSCFHWdUx
TLSH
T1FF232B003BE8812BF2BE4F789DF26145867AF5A36603D54E1CC441DB5713BC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

qmh.buzz:80
qmh.buzz:22
qmh.buzz:8080
qmh.buzz:8880
qmh.buzz:2052
qmh.buzz:2082
qmh.buzz:2086
qmh.buzz:2095
qmh.buzz:443
qmh.buzz:2053
qmh.buzz:2083
qmh.buzz:2087
qmh.buzz:2096
qmh.buzz:8443
www.qmh.buzz:80
www.qmh.buzz:22
www.qmh.buzz:8080
www.qmh.buzz:8880
www.qmh.buzz:2052
www.qmh.buzz:2082
www.qmh.buzz:2086
www.qmh.buzz:2095
www.qmh.buzz:443
www.qmh.buzz:2053
www.qmh.buzz:2083
www.qmh.buzz:2087
www.qmh.buzz:2096
www.qmh.buzz:8443
industroyer.qmh.buzz:80
industroyer.qmh.buzz:22
industroyer.qmh.buzz:8080
industroyer.qmh.buzz:8880
industroyer.qmh.buzz:2052
industroyer.qmh.buzz:2082
industroyer.qmh.buzz:2086
industroyer.qmh.buzz:2095
industroyer.qmh.buzz:443
industroyer.qmh.buzz:2053
industroyer.qmh.buzz:2083
industroyer.qmh.buzz:2087
industroyer.qmh.buzz:2096
industroyer.qmh.buzz:8443
nanocore.qmh.buzz:80
nanocore.qmh.buzz:22
nanocore.qmh.buzz:8080
nanocore.qmh.buzz:8880
nanocore.qmh.buzz:2052
nanocore.qmh.buzz:2082
nanocore.qmh.buzz:2086
nanocore.qmh.buzz:2095
nanocore.qmh.buzz:443
nanocore.qmh.buzz:2053
nanocore.qmh.buzz:2083
nanocore.qmh.buzz:2087
nanocore.qmh.buzz:2096
nanocore.qmh.buzz:8443
codered.qmh.buzz:80
codered.qmh.buzz:22
codered.qmh.buzz:8080
codered.qmh.buzz:8880
codered.qmh.buzz:2052
codered.qmh.buzz:2082
codered.qmh.buzz:2086
codered.qmh.buzz:2095
codered.qmh.buzz:443
codered.qmh.buzz:2053
codered.qmh.buzz:2083
codered.qmh.buzz:2087
codered.qmh.buzz:2096
codered.qmh.buzz:8443
revil.qmh.buzz:80
revil.qmh.buzz:22
revil.qmh.buzz:8080
revil.qmh.buzz:8880
revil.qmh.buzz:2052
revil.qmh.buzz:2082
revil.qmh.buzz:2086
revil.qmh.buzz:2095
revil.qmh.buzz:443
revil.qmh.buzz:2053
revil.qmh.buzz:2083
revil.qmh.buzz:2087
revil.qmh.buzz:2096
revil.qmh.buzz:8443

Mutex

Lk8MzBjqhy13

Attributes

delay
0
install
true
install_file
fzq25.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eefbe7902fa8bd8df076552b7ef6ec446a663711147dddff8fe528b16d4dfc85

File Explorer

eefbe7902fa8bd8df076552b7ef6ec446a663711147dddff8fe528b16d4dfc85

.exe 45KB

eefbe7902fa8bd8df076552b7ef6ec446a663711147dddff8fe528b16d4dfc85

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 eefbe7902fa8bd8df076552b7ef6ec446a663711147dddff8fe528b16d4dfc85
MD5 8620c73efccda6ee5772c83648f7a969
SHA1 0e1443ec60253b2a40d22c0957d06aeefb2d92d8
SHA512 86b22998d1e6c313dc16178406a0209c031cc935b2b204e3830447659ce1736d9b61c3746594637f84f33fe048bcfc05687a32e1041e29437fd3fea5b8f38375
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF4ZTohEaSPIVzjbKgX3iCMCQdJkABDZUx:cu7e5TH2A214Ea7V3bdXSCFHWdUx
TLSH
T1FF232B003BE8812BF2BE4F789DF26145867AF5A36603D54E1CC441DB5713BC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

eefbe7902fa8bd8df076552b7ef6ec446a663711147dddff8fe528b16d4dfc85

mscoree

dotnet