asyncrat | 70a344d6f971b6ee2bdacb8cb932da4db32ccaf3b54d4213d32987de7f0efa4e

Sharing

Copy URL Twitter E-mail

General

Target
70a344d6f971b6ee2bdacb8cb932da4db32ccaf3b54d4213d32987de7f0efa4e
Size 45KB
Sample260804-lfgr4asvbv
SHA256 70a344d6f971b6ee2bdacb8cb932da4db32ccaf3b54d4213d32987de7f0efa4e
MD5 7427532fff7ece253afb705eb4d94157
SHA1 dd2dcc1716e5698277122a855d190bb1ad90f845
SHA512 54dc7adba90e07ef5a274873ef298ee818cb0c4f8be407cc34539b6d29c3250bbe0ebda076e6b980c2dff7086bb0499f84b13b95e3fc66a61ced7ea2161ef53c
SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qrmVlcVl6GcPI+zjbMgX3A6uPl6xa7mLBDZ0x:ruKQpTAOX2NV2X6Gh+3bDXQh687mdd0x
TLSH
T186232C003BE9812BF2BE4F7899F26145867AF6637603D5891CC441DB5723FC68A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexvietnam.com:80
fimsexvietnam.com:22
fimsexvietnam.com:8080
fimsexvietnam.com:8880
fimsexvietnam.com:2052
fimsexvietnam.com:2082
fimsexvietnam.com:2086
fimsexvietnam.com:2095
fimsexvietnam.com:443
fimsexvietnam.com:2053
fimsexvietnam.com:2083
fimsexvietnam.com:2087
fimsexvietnam.com:2096
fimsexvietnam.com:8443
www.fimsexvietnam.com:80
www.fimsexvietnam.com:22
www.fimsexvietnam.com:8080
www.fimsexvietnam.com:8880
www.fimsexvietnam.com:2052
www.fimsexvietnam.com:2082
www.fimsexvietnam.com:2086
www.fimsexvietnam.com:2095
www.fimsexvietnam.com:443
www.fimsexvietnam.com:2053
www.fimsexvietnam.com:2083
www.fimsexvietnam.com:2087
www.fimsexvietnam.com:2096
www.fimsexvietnam.com:8443
cryptolocker.fimsexvietnam.com:80
cryptolocker.fimsexvietnam.com:22
cryptolocker.fimsexvietnam.com:8080
cryptolocker.fimsexvietnam.com:8880
cryptolocker.fimsexvietnam.com:2052
cryptolocker.fimsexvietnam.com:2082
cryptolocker.fimsexvietnam.com:2086
cryptolocker.fimsexvietnam.com:2095
cryptolocker.fimsexvietnam.com:443
cryptolocker.fimsexvietnam.com:2053
cryptolocker.fimsexvietnam.com:2083
cryptolocker.fimsexvietnam.com:2087
cryptolocker.fimsexvietnam.com:2096
cryptolocker.fimsexvietnam.com:8443
iloveyou.fimsexvietnam.com:80
iloveyou.fimsexvietnam.com:22
iloveyou.fimsexvietnam.com:8080
iloveyou.fimsexvietnam.com:8880
iloveyou.fimsexvietnam.com:2052
iloveyou.fimsexvietnam.com:2082
iloveyou.fimsexvietnam.com:2086
iloveyou.fimsexvietnam.com:2095
iloveyou.fimsexvietnam.com:443
iloveyou.fimsexvietnam.com:2053
iloveyou.fimsexvietnam.com:2083
iloveyou.fimsexvietnam.com:2087
iloveyou.fimsexvietnam.com:2096
iloveyou.fimsexvietnam.com:8443
azorult.fimsexvietnam.com:80
azorult.fimsexvietnam.com:22
azorult.fimsexvietnam.com:8080
azorult.fimsexvietnam.com:8880
azorult.fimsexvietnam.com:2052
azorult.fimsexvietnam.com:2082
azorult.fimsexvietnam.com:2086
azorult.fimsexvietnam.com:2095
azorult.fimsexvietnam.com:443
azorult.fimsexvietnam.com:2053
azorult.fimsexvietnam.com:2083
azorult.fimsexvietnam.com:2087
azorult.fimsexvietnam.com:2096
azorult.fimsexvietnam.com:8443
zbot.fimsexvietnam.com:80
zbot.fimsexvietnam.com:22
zbot.fimsexvietnam.com:8080
zbot.fimsexvietnam.com:8880
zbot.fimsexvietnam.com:2052
zbot.fimsexvietnam.com:2082
zbot.fimsexvietnam.com:2086
zbot.fimsexvietnam.com:2095
zbot.fimsexvietnam.com:443
zbot.fimsexvietnam.com:2053
zbot.fimsexvietnam.com:2083
zbot.fimsexvietnam.com:2087
zbot.fimsexvietnam.com:2096
zbot.fimsexvietnam.com:8443

Mutex

9nfQBTm6ZN6k

Attributes

delay
0
install
true
install_file
ff0t.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70a344d6f971b6ee2bdacb8cb932da4db32ccaf3b54d4213d32987de7f0efa4e

File Explorer

70a344d6f971b6ee2bdacb8cb932da4db32ccaf3b54d4213d32987de7f0efa4e

.exe 45KB

70a344d6f971b6ee2bdacb8cb932da4db32ccaf3b54d4213d32987de7f0efa4e

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 70a344d6f971b6ee2bdacb8cb932da4db32ccaf3b54d4213d32987de7f0efa4e
MD5 7427532fff7ece253afb705eb4d94157
SHA1 dd2dcc1716e5698277122a855d190bb1ad90f845
SHA512 54dc7adba90e07ef5a274873ef298ee818cb0c4f8be407cc34539b6d29c3250bbe0ebda076e6b980c2dff7086bb0499f84b13b95e3fc66a61ced7ea2161ef53c
SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qrmVlcVl6GcPI+zjbMgX3A6uPl6xa7mLBDZ0x:ruKQpTAOX2NV2X6Gh+3bDXQh687mdd0x
TLSH
T186232C003BE9812BF2BE4F7899F26145867AF6637603D5891CC441DB5723FC68A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

70a344d6f971b6ee2bdacb8cb932da4db32ccaf3b54d4213d32987de7f0efa4e

mscoree

dotnet