asyncrat | 159d767b2581472a78ff77d2790d8a2b7a1c58307f39b66087def215167239a3

Sharing

Copy URL Twitter E-mail

General

Target
159d767b2581472a78ff77d2790d8a2b7a1c58307f39b66087def215167239a3
Size 45KB
Sample260804-lk8rdagh65
SHA256 159d767b2581472a78ff77d2790d8a2b7a1c58307f39b66087def215167239a3
MD5 75b9e207b728f19d9f750b9d8fb1297c
SHA1 830ca1919022b1a7c0358f27d598c92b522a32d5
SHA512 c305f45acd1ef6d3b6e81e2ed016e1368417052ab23769938ac6abc6e0843ae13af3a5ee16dd30301b7e5a7a26d3c107d53c5f86462d6897595f346f24374ba9
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvFjbygX3i4sPfxhsWtTB1sef1MzBDZEx:MuLAZTnbg2Z4EaHvNb1XS4kxGS91sLVE
TLSH
T142231B103BE8822BF2BE4F78ADF26145467EF5632603D68D1CC411975B13FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

viet69i.com:80
viet69i.com:22
viet69i.com:8080
viet69i.com:8880
viet69i.com:2052
viet69i.com:2082
viet69i.com:2086
viet69i.com:2095
viet69i.com:443
viet69i.com:2053
viet69i.com:2083
viet69i.com:2087
viet69i.com:2096
viet69i.com:8443
www.viet69i.com:80
www.viet69i.com:22
www.viet69i.com:8080
www.viet69i.com:8880
www.viet69i.com:2052
www.viet69i.com:2082
www.viet69i.com:2086
www.viet69i.com:2095
www.viet69i.com:443
www.viet69i.com:2053
www.viet69i.com:2083
www.viet69i.com:2087
www.viet69i.com:2096
www.viet69i.com:8443
gozi.viet69i.com:80
gozi.viet69i.com:22
gozi.viet69i.com:8080
gozi.viet69i.com:8880
gozi.viet69i.com:2052
gozi.viet69i.com:2082
gozi.viet69i.com:2086
gozi.viet69i.com:2095
gozi.viet69i.com:443
gozi.viet69i.com:2053
gozi.viet69i.com:2083
gozi.viet69i.com:2087
gozi.viet69i.com:2096
gozi.viet69i.com:8443
connect.viet69i.com:80
connect.viet69i.com:22
connect.viet69i.com:8080
connect.viet69i.com:8880
connect.viet69i.com:2052
connect.viet69i.com:2082
connect.viet69i.com:2086
connect.viet69i.com:2095
connect.viet69i.com:443
connect.viet69i.com:2053
connect.viet69i.com:2083
connect.viet69i.com:2087
connect.viet69i.com:2096
connect.viet69i.com:8443
clop.viet69i.com:80
clop.viet69i.com:22
clop.viet69i.com:8080
clop.viet69i.com:8880
clop.viet69i.com:2052
clop.viet69i.com:2082
clop.viet69i.com:2086
clop.viet69i.com:2095
clop.viet69i.com:443
clop.viet69i.com:2053
clop.viet69i.com:2083
clop.viet69i.com:2087
clop.viet69i.com:2096
clop.viet69i.com:8443
client.viet69i.com:80
client.viet69i.com:22
client.viet69i.com:8080
client.viet69i.com:8880
client.viet69i.com:2052
client.viet69i.com:2082
client.viet69i.com:2086
client.viet69i.com:2095
client.viet69i.com:443
client.viet69i.com:2053
client.viet69i.com:2083
client.viet69i.com:2087
client.viet69i.com:2096
client.viet69i.com:8443

Mutex

Mea7CAI9w6Tp

Attributes

delay
0
install
true
install_file
k3m67.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
159d767b2581472a78ff77d2790d8a2b7a1c58307f39b66087def215167239a3

File Explorer

159d767b2581472a78ff77d2790d8a2b7a1c58307f39b66087def215167239a3

.exe 45KB

159d767b2581472a78ff77d2790d8a2b7a1c58307f39b66087def215167239a3

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 159d767b2581472a78ff77d2790d8a2b7a1c58307f39b66087def215167239a3
MD5 75b9e207b728f19d9f750b9d8fb1297c
SHA1 830ca1919022b1a7c0358f27d598c92b522a32d5
SHA512 c305f45acd1ef6d3b6e81e2ed016e1368417052ab23769938ac6abc6e0843ae13af3a5ee16dd30301b7e5a7a26d3c107d53c5f86462d6897595f346f24374ba9
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvFjbygX3i4sPfxhsWtTB1sef1MzBDZEx:MuLAZTnbg2Z4EaHvNb1XS4kxGS91sLVE
TLSH
T142231B103BE8822BF2BE4F78ADF26145467EF5632603D68D1CC411975B13FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

159d767b2581472a78ff77d2790d8a2b7a1c58307f39b66087def215167239a3

mscoree

dotnet