asyncrat | a04dee8ee1f69f333011d9dace1d20561cc00840be3a6a74b12b7acb70855acc

Sharing

Copy URL Twitter E-mail

General

Target
a04dee8ee1f69f333011d9dace1d20561cc00840be3a6a74b12b7acb70855acc
Size 45KB
Sample260804-ajfhnaaa22
SHA256 a04dee8ee1f69f333011d9dace1d20561cc00840be3a6a74b12b7acb70855acc
MD5 929439f45cc0c6b0196d1d62c21c74b1
SHA1 11ebd1df3671cedf0cd4848b40d0baac62adedb5
SHA512 55537e9506c721f8bbde262d843c16d6fa02aab095c79653cb7deb97442464886af69c030fc2ae6578ac37c8a890ef6df33932080243468218a234a38f54b3c8
SSDEEP 768:suJdpTP3tcsWUODmqmo2qVyqJaxjwHuPIPzjbvgg3iJAmV9fBDZkx:suJdpTPdI2H3+3P3bYgSuKdkx
TLSH
T116233B003BE8812BF2BE4F78ADF26145867AF6636603D54D2CC452DB5613BC6CA426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimvkl.com:80
phimvkl.com:22
phimvkl.com:8080
phimvkl.com:8880
phimvkl.com:2052
phimvkl.com:2082
phimvkl.com:2086
phimvkl.com:2095
phimvkl.com:443
phimvkl.com:2053
phimvkl.com:2083
phimvkl.com:2087
phimvkl.com:2096
phimvkl.com:8443
www.phimvkl.com:80
www.phimvkl.com:22
www.phimvkl.com:8080
www.phimvkl.com:8880
www.phimvkl.com:2052
www.phimvkl.com:2082
www.phimvkl.com:2086
www.phimvkl.com:2095
www.phimvkl.com:443
www.phimvkl.com:2053
www.phimvkl.com:2083
www.phimvkl.com:2087
www.phimvkl.com:2096
www.phimvkl.com:8443
industroyer.phimvkl.com:80
industroyer.phimvkl.com:22
industroyer.phimvkl.com:8080
industroyer.phimvkl.com:8880
industroyer.phimvkl.com:2052
industroyer.phimvkl.com:2082
industroyer.phimvkl.com:2086
industroyer.phimvkl.com:2095
industroyer.phimvkl.com:443
industroyer.phimvkl.com:2053
industroyer.phimvkl.com:2083
industroyer.phimvkl.com:2087
industroyer.phimvkl.com:2096
industroyer.phimvkl.com:8443
codered.phimvkl.com:80
codered.phimvkl.com:22
codered.phimvkl.com:8080
codered.phimvkl.com:8880
codered.phimvkl.com:2052
codered.phimvkl.com:2082
codered.phimvkl.com:2086
codered.phimvkl.com:2095
codered.phimvkl.com:443
codered.phimvkl.com:2053
codered.phimvkl.com:2083
codered.phimvkl.com:2087
codered.phimvkl.com:2096
codered.phimvkl.com:8443
qbot.phimvkl.com:80
qbot.phimvkl.com:22
qbot.phimvkl.com:8080
qbot.phimvkl.com:8880
qbot.phimvkl.com:2052
qbot.phimvkl.com:2082
qbot.phimvkl.com:2086
qbot.phimvkl.com:2095
qbot.phimvkl.com:443
qbot.phimvkl.com:2053
qbot.phimvkl.com:2083
qbot.phimvkl.com:2087
qbot.phimvkl.com:2096
qbot.phimvkl.com:8443

Mutex

g5H5cbanLSTl

Attributes

delay
0
install
true
install_file
zq7zu3ri.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a04dee8ee1f69f333011d9dace1d20561cc00840be3a6a74b12b7acb70855acc

File Explorer

a04dee8ee1f69f333011d9dace1d20561cc00840be3a6a74b12b7acb70855acc

.exe 45KB

a04dee8ee1f69f333011d9dace1d20561cc00840be3a6a74b12b7acb70855acc

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a04dee8ee1f69f333011d9dace1d20561cc00840be3a6a74b12b7acb70855acc
MD5 929439f45cc0c6b0196d1d62c21c74b1
SHA1 11ebd1df3671cedf0cd4848b40d0baac62adedb5
SHA512 55537e9506c721f8bbde262d843c16d6fa02aab095c79653cb7deb97442464886af69c030fc2ae6578ac37c8a890ef6df33932080243468218a234a38f54b3c8
SSDEEP 768:suJdpTP3tcsWUODmqmo2qVyqJaxjwHuPIPzjbvgg3iJAmV9fBDZkx:suJdpTPdI2H3+3P3bYgSuKdkx
TLSH
T116233B003BE8812BF2BE4F78ADF26145867AF6636603D54D2CC452DB5613BC6CA426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

a04dee8ee1f69f333011d9dace1d20561cc00840be3a6a74b12b7acb70855acc

mscoree

dotnet