asyncrat | 70060e3fd538165fe2c8bc8315974ce64eaad1cb06e1cb0fc2447e5954d1ab34

Sharing

Copy URL Twitter E-mail

General

Target
70060e3fd538165fe2c8bc8315974ce64eaad1cb06e1cb0fc2447e5954d1ab34
Size 45KB
Sample260804-2anw8a1hlc
SHA256 70060e3fd538165fe2c8bc8315974ce64eaad1cb06e1cb0fc2447e5954d1ab34
MD5 90141c0b10116eeb11e2d18c16dae532
SHA1 323c9f4a25e50df14f33c9fa8cadfb3630f05d19
SHA512 cedeee7375878a572b27fbf9ea1b0324f546bba6a1875afd36bb781570265409fadfb37060519f13bf182a2b721b108b50b1e18662dd4263e6e8a3d5422854ff
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9BSEMTFab4OPIM1zjbzgX3R8JLY+IoN/HzBDZ8x:0u1YJTHcw2O2QE3M13bsXhrXCd8x
TLSH
T143231A003BE9822BF2BE4F7898F26146867AF6633603D54D1CC451DB5613FC68A52AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xemcliphot.net:80
xemcliphot.net:22
xemcliphot.net:8080
xemcliphot.net:8880
xemcliphot.net:2052
xemcliphot.net:2082
xemcliphot.net:2086
xemcliphot.net:2095
xemcliphot.net:443
xemcliphot.net:2053
xemcliphot.net:2083
xemcliphot.net:2087
xemcliphot.net:2096
xemcliphot.net:8443
www.xemcliphot.net:80
www.xemcliphot.net:22
www.xemcliphot.net:8080
www.xemcliphot.net:8880
www.xemcliphot.net:2052
www.xemcliphot.net:2082
www.xemcliphot.net:2086
www.xemcliphot.net:2095
www.xemcliphot.net:443
www.xemcliphot.net:2053
www.xemcliphot.net:2083
www.xemcliphot.net:2087
www.xemcliphot.net:2096
www.xemcliphot.net:8443
downadup.xemcliphot.net:80
downadup.xemcliphot.net:22
downadup.xemcliphot.net:8080
downadup.xemcliphot.net:8880
downadup.xemcliphot.net:2052
downadup.xemcliphot.net:2082
downadup.xemcliphot.net:2086
downadup.xemcliphot.net:2095
downadup.xemcliphot.net:443
downadup.xemcliphot.net:2053
downadup.xemcliphot.net:2083
downadup.xemcliphot.net:2087
downadup.xemcliphot.net:2096
downadup.xemcliphot.net:8443
connect.xemcliphot.net:80
connect.xemcliphot.net:22
connect.xemcliphot.net:8080
connect.xemcliphot.net:8880
connect.xemcliphot.net:2052
connect.xemcliphot.net:2082
connect.xemcliphot.net:2086
connect.xemcliphot.net:2095
connect.xemcliphot.net:443
connect.xemcliphot.net:2053
connect.xemcliphot.net:2083
connect.xemcliphot.net:2087
connect.xemcliphot.net:2096
connect.xemcliphot.net:8443

Mutex

IsQXwkuWGW3j

Attributes

delay
0
install
true
install_file
1rfivs.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70060e3fd538165fe2c8bc8315974ce64eaad1cb06e1cb0fc2447e5954d1ab34

File Explorer

70060e3fd538165fe2c8bc8315974ce64eaad1cb06e1cb0fc2447e5954d1ab34

.exe 45KB

70060e3fd538165fe2c8bc8315974ce64eaad1cb06e1cb0fc2447e5954d1ab34

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 70060e3fd538165fe2c8bc8315974ce64eaad1cb06e1cb0fc2447e5954d1ab34
MD5 90141c0b10116eeb11e2d18c16dae532
SHA1 323c9f4a25e50df14f33c9fa8cadfb3630f05d19
SHA512 cedeee7375878a572b27fbf9ea1b0324f546bba6a1875afd36bb781570265409fadfb37060519f13bf182a2b721b108b50b1e18662dd4263e6e8a3d5422854ff
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9BSEMTFab4OPIM1zjbzgX3R8JLY+IoN/HzBDZ8x:0u1YJTHcw2O2QE3M13bsXhrXCd8x
TLSH
T143231A003BE9822BF2BE4F7898F26146867AF6633603D54D1CC451DB5613FC68A52AFD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

70060e3fd538165fe2c8bc8315974ce64eaad1cb06e1cb0fc2447e5954d1ab34

mscoree

dotnet