asyncrat | 2e1461f42b4c004bd67cdd6988f1191ad988131e123bd7c12b5cb0ff1baa3b5c

Sharing

Copy URL Twitter E-mail

General

Target
2e1461f42b4c004bd67cdd6988f1191ad988131e123bd7c12b5cb0ff1baa3b5c
Size 45KB
Sample260804-krvmnagd26
SHA256 2e1461f42b4c004bd67cdd6988f1191ad988131e123bd7c12b5cb0ff1baa3b5c
MD5 c2140b46bc94dc7cc7bf57c845ceba8f
SHA1 90a940008ac0707137d401616b40cb6e60f44eb3
SHA512 b379a55701de5e1e2467c07997785b1ce48c7302dbde7f9eed523d9a3b88d7bfdac99a5611e75a10981551823d0b9b992783bae43a06c67bc9c7d1d0a19b70f7
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QyCBjHSNjPIwzjb/gX3i632UA2N6ibh1BDZsx:EufspTf2g2hO59ESKw3bIXS6O2lddsx
TLSH
T178232A0037E9C12BF2BE4F7898F26145867AF6632603E54A2CC451DB5713FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sextin.org:80
sextin.org:22
sextin.org:8080
sextin.org:8880
sextin.org:2052
sextin.org:2082
sextin.org:2086
sextin.org:2095
sextin.org:443
sextin.org:2053
sextin.org:2083
sextin.org:2087
sextin.org:2096
sextin.org:8443
www.sextin.org:80
www.sextin.org:22
www.sextin.org:8080
www.sextin.org:8880
www.sextin.org:2052
www.sextin.org:2082
www.sextin.org:2086
www.sextin.org:2095
www.sextin.org:443
www.sextin.org:2053
www.sextin.org:2083
www.sextin.org:2087
www.sextin.org:2096
www.sextin.org:8443
clop.sextin.org:80
clop.sextin.org:22
clop.sextin.org:8080
clop.sextin.org:8880
clop.sextin.org:2052
clop.sextin.org:2082
clop.sextin.org:2086
clop.sextin.org:2095
clop.sextin.org:443
clop.sextin.org:2053
clop.sextin.org:2083
clop.sextin.org:2087
clop.sextin.org:2096
clop.sextin.org:8443
gootloader.sextin.org:80
gootloader.sextin.org:22
gootloader.sextin.org:8080
gootloader.sextin.org:8880
gootloader.sextin.org:2052
gootloader.sextin.org:2082
gootloader.sextin.org:2086
gootloader.sextin.org:2095
gootloader.sextin.org:443
gootloader.sextin.org:2053
gootloader.sextin.org:2083
gootloader.sextin.org:2087
gootloader.sextin.org:2096
gootloader.sextin.org:8443
gh0st.sextin.org:80
gh0st.sextin.org:22
gh0st.sextin.org:8080
gh0st.sextin.org:8880
gh0st.sextin.org:2052
gh0st.sextin.org:2082
gh0st.sextin.org:2086
gh0st.sextin.org:2095
gh0st.sextin.org:443
gh0st.sextin.org:2053
gh0st.sextin.org:2083
gh0st.sextin.org:2087
gh0st.sextin.org:2096
gh0st.sextin.org:8443
codered.sextin.org:80
codered.sextin.org:22
codered.sextin.org:8080
codered.sextin.org:8880
codered.sextin.org:2052
codered.sextin.org:2082
codered.sextin.org:2086
codered.sextin.org:2095
codered.sextin.org:443
codered.sextin.org:2053
codered.sextin.org:2083
codered.sextin.org:2087
codered.sextin.org:2096
codered.sextin.org:8443

Mutex

YOOHCG2EelEn

Attributes

delay
0
install
true
install_file
2eoxo6x.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e1461f42b4c004bd67cdd6988f1191ad988131e123bd7c12b5cb0ff1baa3b5c

File Explorer

2e1461f42b4c004bd67cdd6988f1191ad988131e123bd7c12b5cb0ff1baa3b5c

.exe 45KB

2e1461f42b4c004bd67cdd6988f1191ad988131e123bd7c12b5cb0ff1baa3b5c

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2e1461f42b4c004bd67cdd6988f1191ad988131e123bd7c12b5cb0ff1baa3b5c
MD5 c2140b46bc94dc7cc7bf57c845ceba8f
SHA1 90a940008ac0707137d401616b40cb6e60f44eb3
SHA512 b379a55701de5e1e2467c07997785b1ce48c7302dbde7f9eed523d9a3b88d7bfdac99a5611e75a10981551823d0b9b992783bae43a06c67bc9c7d1d0a19b70f7
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QyCBjHSNjPIwzjb/gX3i632UA2N6ibh1BDZsx:EufspTf2g2hO59ESKw3bIXS6O2lddsx
TLSH
T178232A0037E9C12BF2BE4F7898F26145867AF6632603E54A2CC451DB5713FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

2e1461f42b4c004bd67cdd6988f1191ad988131e123bd7c12b5cb0ff1baa3b5c

mscoree

dotnet