asyncrat | 2608d3b46889ca75dc631006d3e93d11db199e5ba3e2f867f588ce907ca9b6ea

Sharing

Copy URL Twitter E-mail

General

Target
2608d3b46889ca75dc631006d3e93d11db199e5ba3e2f867f588ce907ca9b6ea
Size 45KB
Sample260804-m366yatzaw
SHA256 2608d3b46889ca75dc631006d3e93d11db199e5ba3e2f867f588ce907ca9b6ea
MD5 75e7eb1240705b4ec265fbcc4c6f1070
SHA1 23d77a7b1c523ad3b7a7558452f7cb28f604555c
SHA512 cfde9e6e4c6d16337ab95a4f31f6dd1ae07e7463039cc7683b0ed40f75d6c4ef0169613a5fbfa3f63ed7c68bc65e35568d5b6a91cc9e58013c5fc2b313418c06
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAvT9Qpm9PIGzjbEgX3iaPxOkRWPkBQOKFIAQBDZcx:UuKWgSJTwRf2hQG3bLXSaC8BQOrAGdcx
TLSH
T143232A003BED8236F2BE5FB899F26145867AF5232603D58D6CC411DB5723FC6CA426E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

maymaykienlong.com:80
maymaykienlong.com:22
maymaykienlong.com:8080
maymaykienlong.com:8880
maymaykienlong.com:2052
maymaykienlong.com:2082
maymaykienlong.com:2086
maymaykienlong.com:2095
maymaykienlong.com:443
maymaykienlong.com:2053
maymaykienlong.com:2083
maymaykienlong.com:2087
maymaykienlong.com:2096
maymaykienlong.com:8443
www.maymaykienlong.com:80
www.maymaykienlong.com:22
www.maymaykienlong.com:8080
www.maymaykienlong.com:8880
www.maymaykienlong.com:2052
www.maymaykienlong.com:2082
www.maymaykienlong.com:2086
www.maymaykienlong.com:2095
www.maymaykienlong.com:443
www.maymaykienlong.com:2053
www.maymaykienlong.com:2083
www.maymaykienlong.com:2087
www.maymaykienlong.com:2096
www.maymaykienlong.com:8443
zeus.maymaykienlong.com:80
zeus.maymaykienlong.com:22
zeus.maymaykienlong.com:8080
zeus.maymaykienlong.com:8880
zeus.maymaykienlong.com:2052
zeus.maymaykienlong.com:2082
zeus.maymaykienlong.com:2086
zeus.maymaykienlong.com:2095
zeus.maymaykienlong.com:443
zeus.maymaykienlong.com:2053
zeus.maymaykienlong.com:2083
zeus.maymaykienlong.com:2087
zeus.maymaykienlong.com:2096
zeus.maymaykienlong.com:8443
downadup.maymaykienlong.com:80
downadup.maymaykienlong.com:22
downadup.maymaykienlong.com:8080
downadup.maymaykienlong.com:8880
downadup.maymaykienlong.com:2052
downadup.maymaykienlong.com:2082
downadup.maymaykienlong.com:2086
downadup.maymaykienlong.com:2095
downadup.maymaykienlong.com:443
downadup.maymaykienlong.com:2053
downadup.maymaykienlong.com:2083
downadup.maymaykienlong.com:2087
downadup.maymaykienlong.com:2096
downadup.maymaykienlong.com:8443
hack.maymaykienlong.com:80
hack.maymaykienlong.com:22
hack.maymaykienlong.com:8080
hack.maymaykienlong.com:8880
hack.maymaykienlong.com:2052
hack.maymaykienlong.com:2082
hack.maymaykienlong.com:2086
hack.maymaykienlong.com:2095
hack.maymaykienlong.com:443
hack.maymaykienlong.com:2053
hack.maymaykienlong.com:2083
hack.maymaykienlong.com:2087
hack.maymaykienlong.com:2096
hack.maymaykienlong.com:8443

Mutex

pCmqXS1OtePo

Attributes

delay
0
install
true
install_file
e6nipng5.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2608d3b46889ca75dc631006d3e93d11db199e5ba3e2f867f588ce907ca9b6ea

File Explorer

2608d3b46889ca75dc631006d3e93d11db199e5ba3e2f867f588ce907ca9b6ea

.exe 45KB

2608d3b46889ca75dc631006d3e93d11db199e5ba3e2f867f588ce907ca9b6ea

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2608d3b46889ca75dc631006d3e93d11db199e5ba3e2f867f588ce907ca9b6ea
MD5 75e7eb1240705b4ec265fbcc4c6f1070
SHA1 23d77a7b1c523ad3b7a7558452f7cb28f604555c
SHA512 cfde9e6e4c6d16337ab95a4f31f6dd1ae07e7463039cc7683b0ed40f75d6c4ef0169613a5fbfa3f63ed7c68bc65e35568d5b6a91cc9e58013c5fc2b313418c06
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAvT9Qpm9PIGzjbEgX3iaPxOkRWPkBQOKFIAQBDZcx:UuKWgSJTwRf2hQG3bLXSaC8BQOrAGdcx
TLSH
T143232A003BED8236F2BE5FB899F26145867AF5232603D58D6CC411DB5723FC6CA426E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

2608d3b46889ca75dc631006d3e93d11db199e5ba3e2f867f588ce907ca9b6ea

mscoree

dotnet