asyncrat | bf9c5fc813c30c9e0508b8d4da80b0ad480c2c04b093ee36f7a1bf654a719005

Sharing

Copy URL Twitter E-mail

General

Target
bf9c5fc813c30c9e0508b8d4da80b0ad480c2c04b093ee36f7a1bf654a719005
Size 45KB
Sample260804-awjqvadr3x
SHA256 bf9c5fc813c30c9e0508b8d4da80b0ad480c2c04b093ee36f7a1bf654a719005
MD5 f0c8defab52ee4605ac81a560799ebb2
SHA1 1fe2602b5da0ac952ecbd8732b048a6138260510
SHA512 8b0ac2a120439e7e33362b1c25995b40a2799806af60a9862a293b9b1e5dd8524a58227043e2adb9796ba4cd03c3c9149eab6bf8834df709db68c5f775d98571
SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQElsNoPEaMPIcSjb3gX3i37UyL8vFiZ5JBDZUx:cuqb5TrhG2gsuEaxc+bQXS334vaXdUx
TLSH
T17C232B003BE8812BF2BE8F786CF26245467AF5B36603D5891CC4519B4713FC6DA526FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xemcliphot.net:80
xemcliphot.net:22
xemcliphot.net:8080
xemcliphot.net:8880
xemcliphot.net:2052
xemcliphot.net:2082
xemcliphot.net:2086
xemcliphot.net:2095
xemcliphot.net:443
xemcliphot.net:2053
xemcliphot.net:2083
xemcliphot.net:2087
xemcliphot.net:2096
xemcliphot.net:8443
www.xemcliphot.net:80
www.xemcliphot.net:22
www.xemcliphot.net:8080
www.xemcliphot.net:8880
www.xemcliphot.net:2052
www.xemcliphot.net:2082
www.xemcliphot.net:2086
www.xemcliphot.net:2095
www.xemcliphot.net:443
www.xemcliphot.net:2053
www.xemcliphot.net:2083
www.xemcliphot.net:2087
www.xemcliphot.net:2096
www.xemcliphot.net:8443
invasive.xemcliphot.net:80
invasive.xemcliphot.net:22
invasive.xemcliphot.net:8080
invasive.xemcliphot.net:8880
invasive.xemcliphot.net:2052
invasive.xemcliphot.net:2082
invasive.xemcliphot.net:2086
invasive.xemcliphot.net:2095
invasive.xemcliphot.net:443
invasive.xemcliphot.net:2053
invasive.xemcliphot.net:2083
invasive.xemcliphot.net:2087
invasive.xemcliphot.net:2096
invasive.xemcliphot.net:8443
cryptolocker.xemcliphot.net:80
cryptolocker.xemcliphot.net:22
cryptolocker.xemcliphot.net:8080
cryptolocker.xemcliphot.net:8880
cryptolocker.xemcliphot.net:2052
cryptolocker.xemcliphot.net:2082
cryptolocker.xemcliphot.net:2086
cryptolocker.xemcliphot.net:2095
cryptolocker.xemcliphot.net:443
cryptolocker.xemcliphot.net:2053
cryptolocker.xemcliphot.net:2083
cryptolocker.xemcliphot.net:2087
cryptolocker.xemcliphot.net:2096
cryptolocker.xemcliphot.net:8443
socgholish.xemcliphot.net:80
socgholish.xemcliphot.net:22
socgholish.xemcliphot.net:8080
socgholish.xemcliphot.net:8880
socgholish.xemcliphot.net:2052
socgholish.xemcliphot.net:2082
socgholish.xemcliphot.net:2086
socgholish.xemcliphot.net:2095
socgholish.xemcliphot.net:443
socgholish.xemcliphot.net:2053
socgholish.xemcliphot.net:2083
socgholish.xemcliphot.net:2087
socgholish.xemcliphot.net:2096
socgholish.xemcliphot.net:8443
stuxnet.xemcliphot.net:80
stuxnet.xemcliphot.net:22
stuxnet.xemcliphot.net:8080
stuxnet.xemcliphot.net:8880
stuxnet.xemcliphot.net:2052
stuxnet.xemcliphot.net:2082
stuxnet.xemcliphot.net:2086
stuxnet.xemcliphot.net:2095
stuxnet.xemcliphot.net:443
stuxnet.xemcliphot.net:2053
stuxnet.xemcliphot.net:2083
stuxnet.xemcliphot.net:2087
stuxnet.xemcliphot.net:2096
stuxnet.xemcliphot.net:8443

Mutex

eiEnKki6s5Md

Attributes

delay
0
install
true
install_file
lamzc.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf9c5fc813c30c9e0508b8d4da80b0ad480c2c04b093ee36f7a1bf654a719005

File Explorer

bf9c5fc813c30c9e0508b8d4da80b0ad480c2c04b093ee36f7a1bf654a719005

.exe 45KB

bf9c5fc813c30c9e0508b8d4da80b0ad480c2c04b093ee36f7a1bf654a719005

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 bf9c5fc813c30c9e0508b8d4da80b0ad480c2c04b093ee36f7a1bf654a719005
MD5 f0c8defab52ee4605ac81a560799ebb2
SHA1 1fe2602b5da0ac952ecbd8732b048a6138260510
SHA512 8b0ac2a120439e7e33362b1c25995b40a2799806af60a9862a293b9b1e5dd8524a58227043e2adb9796ba4cd03c3c9149eab6bf8834df709db68c5f775d98571
SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQElsNoPEaMPIcSjb3gX3i37UyL8vFiZ5JBDZUx:cuqb5TrhG2gsuEaxc+bQXS334vaXdUx
TLSH
T17C232B003BE8812BF2BE8F786CF26245467AF5B36603D5891CC4519B4713FC6DA526FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

bf9c5fc813c30c9e0508b8d4da80b0ad480c2c04b093ee36f7a1bf654a719005

mscoree

dotnet