asyncrat | 382630734e2805751ff059ed89444153efd7becfd6ec51d26ceda49843aff8bf

Sharing

Copy URL Twitter E-mail

General

Target
382630734e2805751ff059ed89444153efd7becfd6ec51d26ceda49843aff8bf
Size 45KB
Sample260804-t135tsdf58
SHA256 382630734e2805751ff059ed89444153efd7becfd6ec51d26ceda49843aff8bf
MD5 29b232ab3fbb8de9362001d9ca48ceb7
SHA1 38c0920c70da21158887d448d70a2fdf6c120c8b
SHA512 0c8363eaa71e9487aaa04d842d7b7adaac35cb701103a021df06ed0199bdc01d55b5e083b230812731c669f776e8d84a119b1cf27cd3ae5f44e22b62fc15b599
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9iiD8yfzuOPIZzjbBgXaiWf9nmnkM40/4y1sBDZ8x:0uPrpT/qY2fiAJ3Z3buXjWVmr0d8x
TLSH
T1D72329003BE9812BF2BE4FB898F26144467AF6633603D54A1CC4519B5B13FC69B426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

qmh.buzz:80
qmh.buzz:22
qmh.buzz:8080
qmh.buzz:8880
qmh.buzz:2052
qmh.buzz:2082
qmh.buzz:2086
qmh.buzz:2095
qmh.buzz:443
qmh.buzz:2053
qmh.buzz:2083
qmh.buzz:2087
qmh.buzz:2096
qmh.buzz:8443
www.qmh.buzz:80
www.qmh.buzz:22
www.qmh.buzz:8080
www.qmh.buzz:8880
www.qmh.buzz:2052
www.qmh.buzz:2082
www.qmh.buzz:2086
www.qmh.buzz:2095
www.qmh.buzz:443
www.qmh.buzz:2053
www.qmh.buzz:2083
www.qmh.buzz:2087
www.qmh.buzz:2096
www.qmh.buzz:8443
lokibot.qmh.buzz:80
lokibot.qmh.buzz:22
lokibot.qmh.buzz:8080
lokibot.qmh.buzz:8880
lokibot.qmh.buzz:2052
lokibot.qmh.buzz:2082
lokibot.qmh.buzz:2086
lokibot.qmh.buzz:2095
lokibot.qmh.buzz:443
lokibot.qmh.buzz:2053
lokibot.qmh.buzz:2083
lokibot.qmh.buzz:2087
lokibot.qmh.buzz:2096
lokibot.qmh.buzz:8443
gozi.qmh.buzz:80
gozi.qmh.buzz:22
gozi.qmh.buzz:8080
gozi.qmh.buzz:8880
gozi.qmh.buzz:2052
gozi.qmh.buzz:2082
gozi.qmh.buzz:2086
gozi.qmh.buzz:2095
gozi.qmh.buzz:443
gozi.qmh.buzz:2053
gozi.qmh.buzz:2083
gozi.qmh.buzz:2087
gozi.qmh.buzz:2096
gozi.qmh.buzz:8443
trisis.qmh.buzz:80
trisis.qmh.buzz:22
trisis.qmh.buzz:8080
trisis.qmh.buzz:8880
trisis.qmh.buzz:2052
trisis.qmh.buzz:2082
trisis.qmh.buzz:2086
trisis.qmh.buzz:2095
trisis.qmh.buzz:443
trisis.qmh.buzz:2053
trisis.qmh.buzz:2083
trisis.qmh.buzz:2087
trisis.qmh.buzz:2096
trisis.qmh.buzz:8443
hermeticwiper.qmh.buzz:80
hermeticwiper.qmh.buzz:22
hermeticwiper.qmh.buzz:8080
hermeticwiper.qmh.buzz:8880
hermeticwiper.qmh.buzz:2052
hermeticwiper.qmh.buzz:2082
hermeticwiper.qmh.buzz:2086
hermeticwiper.qmh.buzz:2095
hermeticwiper.qmh.buzz:443
hermeticwiper.qmh.buzz:2053
hermeticwiper.qmh.buzz:2083
hermeticwiper.qmh.buzz:2087
hermeticwiper.qmh.buzz:2096
hermeticwiper.qmh.buzz:8443

Mutex

Nt9ft6pEEFnb

Attributes

delay
0
install
true
install_file
2j838wq.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
382630734e2805751ff059ed89444153efd7becfd6ec51d26ceda49843aff8bf

File Explorer

382630734e2805751ff059ed89444153efd7becfd6ec51d26ceda49843aff8bf

.exe 45KB

382630734e2805751ff059ed89444153efd7becfd6ec51d26ceda49843aff8bf

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 382630734e2805751ff059ed89444153efd7becfd6ec51d26ceda49843aff8bf
MD5 29b232ab3fbb8de9362001d9ca48ceb7
SHA1 38c0920c70da21158887d448d70a2fdf6c120c8b
SHA512 0c8363eaa71e9487aaa04d842d7b7adaac35cb701103a021df06ed0199bdc01d55b5e083b230812731c669f776e8d84a119b1cf27cd3ae5f44e22b62fc15b599
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9iiD8yfzuOPIZzjbBgXaiWf9nmnkM40/4y1sBDZ8x:0uPrpT/qY2fiAJ3Z3buXjWVmr0d8x
TLSH
T1D72329003BE9812BF2BE4FB898F26144467AF6633603D54A1CC4519B5B13FC69B426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

382630734e2805751ff059ed89444153efd7becfd6ec51d26ceda49843aff8bf

mscoree

dotnet