asyncrat | 06a011a49b9ef4606f50f9010b11b46741318a4f510bc20c1422706aa29342bf

Sharing

Copy URL Twitter E-mail

General

Target
06a011a49b9ef4606f50f9010b11b46741318a4f510bc20c1422706aa29342bf
Size 45KB
Sample260804-mjs5zahe94
SHA256 06a011a49b9ef4606f50f9010b11b46741318a4f510bc20c1422706aa29342bf
MD5 a1baa7ac649711e29dd0bb2f3cf0c57d
SHA1 604c275b39fff45acfb3cdf93e29965deb3597e0
SHA512 484d4650566a1652dcb4d1c1e8592482641014fd573691323a552f338fc1d0552c09eb7fe6efde7aa759fa0e50e89f448db47c06399905cd902ca4e9d350696c
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9i9oSsqHz1OPIqzjb2gd3iu6uUbfftruNlQerPBDZ8x:0uPrpT/qY2/Kti3q3bpdSuu3tafn5d8x
TLSH
T173233A003BE9C12BF2BE4F78A8F26145867AF6632603D64D1CC451DB5713BC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xemsexmy.org:80
xemsexmy.org:22
xemsexmy.org:8080
xemsexmy.org:8880
xemsexmy.org:2052
xemsexmy.org:2082
xemsexmy.org:2086
xemsexmy.org:2095
xemsexmy.org:443
xemsexmy.org:2053
xemsexmy.org:2083
xemsexmy.org:2087
xemsexmy.org:2096
xemsexmy.org:8443
www.xemsexmy.org:80
www.xemsexmy.org:22
www.xemsexmy.org:8080
www.xemsexmy.org:8880
www.xemsexmy.org:2052
www.xemsexmy.org:2082
www.xemsexmy.org:2086
www.xemsexmy.org:2095
www.xemsexmy.org:443
www.xemsexmy.org:2053
www.xemsexmy.org:2083
www.xemsexmy.org:2087
www.xemsexmy.org:2096
www.xemsexmy.org:8443
rat.xemsexmy.org:80
rat.xemsexmy.org:22
rat.xemsexmy.org:8080
rat.xemsexmy.org:8880
rat.xemsexmy.org:2052
rat.xemsexmy.org:2082
rat.xemsexmy.org:2086
rat.xemsexmy.org:2095
rat.xemsexmy.org:443
rat.xemsexmy.org:2053
rat.xemsexmy.org:2083
rat.xemsexmy.org:2087
rat.xemsexmy.org:2096
rat.xemsexmy.org:8443
mydoom.xemsexmy.org:80
mydoom.xemsexmy.org:22
mydoom.xemsexmy.org:8080
mydoom.xemsexmy.org:8880
mydoom.xemsexmy.org:2052
mydoom.xemsexmy.org:2082
mydoom.xemsexmy.org:2086
mydoom.xemsexmy.org:2095
mydoom.xemsexmy.org:443
mydoom.xemsexmy.org:2053
mydoom.xemsexmy.org:2083
mydoom.xemsexmy.org:2087
mydoom.xemsexmy.org:2096
mydoom.xemsexmy.org:8443
notpetya.xemsexmy.org:80
notpetya.xemsexmy.org:22
notpetya.xemsexmy.org:8080
notpetya.xemsexmy.org:8880
notpetya.xemsexmy.org:2052
notpetya.xemsexmy.org:2082
notpetya.xemsexmy.org:2086
notpetya.xemsexmy.org:2095
notpetya.xemsexmy.org:443
notpetya.xemsexmy.org:2053
notpetya.xemsexmy.org:2083
notpetya.xemsexmy.org:2087
notpetya.xemsexmy.org:2096
notpetya.xemsexmy.org:8443

Mutex

ZuqWPAKnKdHp

Attributes

delay
0
install
true
install_file
yb7sibl.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06a011a49b9ef4606f50f9010b11b46741318a4f510bc20c1422706aa29342bf

File Explorer

06a011a49b9ef4606f50f9010b11b46741318a4f510bc20c1422706aa29342bf

.exe 45KB

06a011a49b9ef4606f50f9010b11b46741318a4f510bc20c1422706aa29342bf

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 06a011a49b9ef4606f50f9010b11b46741318a4f510bc20c1422706aa29342bf
MD5 a1baa7ac649711e29dd0bb2f3cf0c57d
SHA1 604c275b39fff45acfb3cdf93e29965deb3597e0
SHA512 484d4650566a1652dcb4d1c1e8592482641014fd573691323a552f338fc1d0552c09eb7fe6efde7aa759fa0e50e89f448db47c06399905cd902ca4e9d350696c
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9i9oSsqHz1OPIqzjb2gd3iu6uUbfftruNlQerPBDZ8x:0uPrpT/qY2/Kti3q3bpdSuu3tafn5d8x
TLSH
T173233A003BE9C12BF2BE4F78A8F26145867AF6632603D64D1CC451DB5713BC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

06a011a49b9ef4606f50f9010b11b46741318a4f510bc20c1422706aa29342bf

mscoree

dotnet