asyncrat | c71e7a782bf4b137e14f3896bdb971fafca0b6e13238c4e219b29264466cbb08

Sharing

Copy URL Twitter E-mail

General

Target
c71e7a782bf4b137e14f3896bdb971fafca0b6e13238c4e219b29264466cbb08
Size 45KB
Sample260804-hlmnraytat
SHA256 c71e7a782bf4b137e14f3896bdb971fafca0b6e13238c4e219b29264466cbb08
MD5 87227acb0904068aa7c4b0fb882b6d59
SHA1 c799af8393121c750b8460de1ad5dccedcb8c79d
SHA512 0070194d8f7ee03b9360cfbc13da3d1c43db8c26752c66e93b31c4e27caa744dc67b6cdfc9b9ed0338e5d04b8c6390467db8bccccc5eaa3ee92baa0f2266dc26
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9kIz/yPqiPIdzjb5gX3iogxljEvnAweZO1jBDZsx:EufspTf2g2/c5d3bWXSNfkAXZO7dsx
TLSH
T1A7232A003BE9C13BE2BE5BB49DF26145467AF6633A03D54E1CC411DB5713BC68A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexviet41.com:80
sexviet41.com:22
sexviet41.com:8080
sexviet41.com:8880
sexviet41.com:2052
sexviet41.com:2082
sexviet41.com:2086
sexviet41.com:2095
sexviet41.com:443
sexviet41.com:2053
sexviet41.com:2083
sexviet41.com:2087
sexviet41.com:2096
sexviet41.com:8443
www.sexviet41.com:80
www.sexviet41.com:22
www.sexviet41.com:8080
www.sexviet41.com:8880
www.sexviet41.com:2052
www.sexviet41.com:2082
www.sexviet41.com:2086
www.sexviet41.com:2095
www.sexviet41.com:443
www.sexviet41.com:2053
www.sexviet41.com:2083
www.sexviet41.com:2087
www.sexviet41.com:2096
www.sexviet41.com:8443
gh0st.sexviet41.com:80
gh0st.sexviet41.com:22
gh0st.sexviet41.com:8080
gh0st.sexviet41.com:8880
gh0st.sexviet41.com:2052
gh0st.sexviet41.com:2082
gh0st.sexviet41.com:2086
gh0st.sexviet41.com:2095
gh0st.sexviet41.com:443
gh0st.sexviet41.com:2053
gh0st.sexviet41.com:2083
gh0st.sexviet41.com:2087
gh0st.sexviet41.com:2096
gh0st.sexviet41.com:8443
azorult.sexviet41.com:80
azorult.sexviet41.com:22
azorult.sexviet41.com:8080
azorult.sexviet41.com:8880
azorult.sexviet41.com:2052
azorult.sexviet41.com:2082
azorult.sexviet41.com:2086
azorult.sexviet41.com:2095
azorult.sexviet41.com:443
azorult.sexviet41.com:2053
azorult.sexviet41.com:2083
azorult.sexviet41.com:2087
azorult.sexviet41.com:2096
azorult.sexviet41.com:8443
fakeupdates.sexviet41.com:80
fakeupdates.sexviet41.com:22
fakeupdates.sexviet41.com:8080
fakeupdates.sexviet41.com:8880
fakeupdates.sexviet41.com:2052
fakeupdates.sexviet41.com:2082
fakeupdates.sexviet41.com:2086
fakeupdates.sexviet41.com:2095
fakeupdates.sexviet41.com:443
fakeupdates.sexviet41.com:2053
fakeupdates.sexviet41.com:2083
fakeupdates.sexviet41.com:2087
fakeupdates.sexviet41.com:2096
fakeupdates.sexviet41.com:8443

Mutex

qetzlZMeho90

Attributes

delay
0
install
true
install_file
yl3nbr1.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c71e7a782bf4b137e14f3896bdb971fafca0b6e13238c4e219b29264466cbb08

File Explorer

c71e7a782bf4b137e14f3896bdb971fafca0b6e13238c4e219b29264466cbb08

.exe 45KB

c71e7a782bf4b137e14f3896bdb971fafca0b6e13238c4e219b29264466cbb08

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c71e7a782bf4b137e14f3896bdb971fafca0b6e13238c4e219b29264466cbb08
MD5 87227acb0904068aa7c4b0fb882b6d59
SHA1 c799af8393121c750b8460de1ad5dccedcb8c79d
SHA512 0070194d8f7ee03b9360cfbc13da3d1c43db8c26752c66e93b31c4e27caa744dc67b6cdfc9b9ed0338e5d04b8c6390467db8bccccc5eaa3ee92baa0f2266dc26
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9kIz/yPqiPIdzjb5gX3iogxljEvnAweZO1jBDZsx:EufspTf2g2/c5d3bWXSNfkAXZO7dsx
TLSH
T1A7232A003BE9C13BE2BE5BB49DF26145467AF6633A03D54E1CC411DB5713BC68A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c71e7a782bf4b137e14f3896bdb971fafca0b6e13238c4e219b29264466cbb08

mscoree

dotnet