asyncrat | 204d6573337e0f209ad1dc795d001f4ae73aa0cec82e95b4d0d4d3c159f2afd6

Sharing

Copy URL Twitter E-mail

General

Target
204d6573337e0f209ad1dc795d001f4ae73aa0cec82e95b4d0d4d3c159f2afd6
Size 45KB
Sample260804-p87e1afk3w
SHA256 204d6573337e0f209ad1dc795d001f4ae73aa0cec82e95b4d0d4d3c159f2afd6
MD5 9c3ba652471dbde7caa1eeda8c02420e
SHA1 4352d2e24b38c063184168a0e7c603fcae0bedf2
SHA512 8528beb4394c57906650463add2b46379cec0ff6b7f7a4432c8a4eb23dd8cd4a1bf6fc955cfd6321042a966c948e7a8283f7ead7629a8ecbdac691e731abcae4
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVu8kLyuObvtkjZPICzjbWgX5ip8IPoK89iFBDZEx:MuBGJTPho2H8LuyyjWC3bJXIaWoKvLdG
TLSH
T14C232A0037E9812BF2BE4F78A8F26145867BF6637603D54A1CC451DB5A13FC6CA42AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sas-cdn.com:80
sas-cdn.com:22
sas-cdn.com:8080
sas-cdn.com:8880
sas-cdn.com:2052
sas-cdn.com:2082
sas-cdn.com:2086
sas-cdn.com:2095
sas-cdn.com:443
sas-cdn.com:2053
sas-cdn.com:2083
sas-cdn.com:2087
sas-cdn.com:2096
sas-cdn.com:8443
www.sas-cdn.com:80
www.sas-cdn.com:22
www.sas-cdn.com:8080
www.sas-cdn.com:8880
www.sas-cdn.com:2052
www.sas-cdn.com:2082
www.sas-cdn.com:2086
www.sas-cdn.com:2095
www.sas-cdn.com:443
www.sas-cdn.com:2053
www.sas-cdn.com:2083
www.sas-cdn.com:2087
www.sas-cdn.com:2096
www.sas-cdn.com:8443
wannacry.sas-cdn.com:80
wannacry.sas-cdn.com:22
wannacry.sas-cdn.com:8080
wannacry.sas-cdn.com:8880
wannacry.sas-cdn.com:2052
wannacry.sas-cdn.com:2082
wannacry.sas-cdn.com:2086
wannacry.sas-cdn.com:2095
wannacry.sas-cdn.com:443
wannacry.sas-cdn.com:2053
wannacry.sas-cdn.com:2083
wannacry.sas-cdn.com:2087
wannacry.sas-cdn.com:2096
wannacry.sas-cdn.com:8443
nimda.sas-cdn.com:80
nimda.sas-cdn.com:22
nimda.sas-cdn.com:8080
nimda.sas-cdn.com:8880
nimda.sas-cdn.com:2052
nimda.sas-cdn.com:2082
nimda.sas-cdn.com:2086
nimda.sas-cdn.com:2095
nimda.sas-cdn.com:443
nimda.sas-cdn.com:2053
nimda.sas-cdn.com:2083
nimda.sas-cdn.com:2087
nimda.sas-cdn.com:2096
nimda.sas-cdn.com:8443
ursnif.sas-cdn.com:80
ursnif.sas-cdn.com:22
ursnif.sas-cdn.com:8080
ursnif.sas-cdn.com:8880
ursnif.sas-cdn.com:2052
ursnif.sas-cdn.com:2082
ursnif.sas-cdn.com:2086
ursnif.sas-cdn.com:2095
ursnif.sas-cdn.com:443
ursnif.sas-cdn.com:2053
ursnif.sas-cdn.com:2083
ursnif.sas-cdn.com:2087
ursnif.sas-cdn.com:2096
ursnif.sas-cdn.com:8443
gozi.sas-cdn.com:80
gozi.sas-cdn.com:22
gozi.sas-cdn.com:8080
gozi.sas-cdn.com:8880
gozi.sas-cdn.com:2052
gozi.sas-cdn.com:2082
gozi.sas-cdn.com:2086
gozi.sas-cdn.com:2095
gozi.sas-cdn.com:443
gozi.sas-cdn.com:2053
gozi.sas-cdn.com:2083
gozi.sas-cdn.com:2087
gozi.sas-cdn.com:2096
gozi.sas-cdn.com:8443

Mutex

tDvKxxy8dMGh

Attributes

delay
0
install
true
install_file
4e3r.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
204d6573337e0f209ad1dc795d001f4ae73aa0cec82e95b4d0d4d3c159f2afd6

File Explorer

204d6573337e0f209ad1dc795d001f4ae73aa0cec82e95b4d0d4d3c159f2afd6

.exe 45KB

204d6573337e0f209ad1dc795d001f4ae73aa0cec82e95b4d0d4d3c159f2afd6

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 204d6573337e0f209ad1dc795d001f4ae73aa0cec82e95b4d0d4d3c159f2afd6
MD5 9c3ba652471dbde7caa1eeda8c02420e
SHA1 4352d2e24b38c063184168a0e7c603fcae0bedf2
SHA512 8528beb4394c57906650463add2b46379cec0ff6b7f7a4432c8a4eb23dd8cd4a1bf6fc955cfd6321042a966c948e7a8283f7ead7629a8ecbdac691e731abcae4
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVu8kLyuObvtkjZPICzjbWgX5ip8IPoK89iFBDZEx:MuBGJTPho2H8LuyyjWC3bJXIaWoKvLdG
TLSH
T14C232A0037E9812BF2BE4F78A8F26145867BF6637603D54A1CC451DB5A13FC6CA42AED
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

204d6573337e0f209ad1dc795d001f4ae73aa0cec82e95b4d0d4d3c159f2afd6

mscoree

dotnet