asyncrat | 8a5a137ab1aabbcd3f9acdf2f409be47488dfa9fc9df6078d3cf2daaebbc9d83

Sharing

Copy URL Twitter E-mail

General

Target
8a5a137ab1aabbcd3f9acdf2f409be47488dfa9fc9df6078d3cf2daaebbc9d83
Size 45KB
Sample260804-tgwlmstgrd
SHA256 8a5a137ab1aabbcd3f9acdf2f409be47488dfa9fc9df6078d3cf2daaebbc9d83
MD5 1c3807f9cb39a36f1ec97350ccb0daf8
SHA1 33d7637102be33d61fcb98a29d5ce755835073d7
SHA512 970601e75663ec9aecb5ce8d3f82878dbda41ff0d79c9a06fc0c468d9f5457f3c3264ce1b86eaf75f6f3e6b427c1ccb5bcef9c8ef50ca17846c65bf63d6bdd78
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA5Bz5U4x7PIgEjb5gX3iwccaqiOlNQJ5ijBDZcx:UuKWgSJTwRf2pj6gEbWXSL5qiYNG52de
TLSH
T178232B003BE8C12BF2BE4FB8ACF26145467AF6636603D5496CC451DB5713BC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sextinvl.blog:80
sextinvl.blog:22
sextinvl.blog:8080
sextinvl.blog:8880
sextinvl.blog:2052
sextinvl.blog:2082
sextinvl.blog:2086
sextinvl.blog:2095
sextinvl.blog:443
sextinvl.blog:2053
sextinvl.blog:2083
sextinvl.blog:2087
sextinvl.blog:2096
sextinvl.blog:8443
www.sextinvl.blog:80
www.sextinvl.blog:22
www.sextinvl.blog:8080
www.sextinvl.blog:8880
www.sextinvl.blog:2052
www.sextinvl.blog:2082
www.sextinvl.blog:2086
www.sextinvl.blog:2095
www.sextinvl.blog:443
www.sextinvl.blog:2053
www.sextinvl.blog:2083
www.sextinvl.blog:2087
www.sextinvl.blog:2096
www.sextinvl.blog:8443
iloveyou.sextinvl.blog:80
iloveyou.sextinvl.blog:22
iloveyou.sextinvl.blog:8080
iloveyou.sextinvl.blog:8880
iloveyou.sextinvl.blog:2052
iloveyou.sextinvl.blog:2082
iloveyou.sextinvl.blog:2086
iloveyou.sextinvl.blog:2095
iloveyou.sextinvl.blog:443
iloveyou.sextinvl.blog:2053
iloveyou.sextinvl.blog:2083
iloveyou.sextinvl.blog:2087
iloveyou.sextinvl.blog:2096
iloveyou.sextinvl.blog:8443
sobig.sextinvl.blog:80
sobig.sextinvl.blog:22
sobig.sextinvl.blog:8080
sobig.sextinvl.blog:8880
sobig.sextinvl.blog:2052
sobig.sextinvl.blog:2082
sobig.sextinvl.blog:2086
sobig.sextinvl.blog:2095
sobig.sextinvl.blog:443
sobig.sextinvl.blog:2053
sobig.sextinvl.blog:2083
sobig.sextinvl.blog:2087
sobig.sextinvl.blog:2096
sobig.sextinvl.blog:8443
nimda.sextinvl.blog:80
nimda.sextinvl.blog:22
nimda.sextinvl.blog:8080
nimda.sextinvl.blog:8880
nimda.sextinvl.blog:2052
nimda.sextinvl.blog:2082
nimda.sextinvl.blog:2086
nimda.sextinvl.blog:2095
nimda.sextinvl.blog:443
nimda.sextinvl.blog:2053
nimda.sextinvl.blog:2083
nimda.sextinvl.blog:2087
nimda.sextinvl.blog:2096
nimda.sextinvl.blog:8443
hermeticwiper.sextinvl.blog:80
hermeticwiper.sextinvl.blog:22
hermeticwiper.sextinvl.blog:8080
hermeticwiper.sextinvl.blog:8880
hermeticwiper.sextinvl.blog:2052
hermeticwiper.sextinvl.blog:2082
hermeticwiper.sextinvl.blog:2086
hermeticwiper.sextinvl.blog:2095
hermeticwiper.sextinvl.blog:443
hermeticwiper.sextinvl.blog:2053
hermeticwiper.sextinvl.blog:2083
hermeticwiper.sextinvl.blog:2087
hermeticwiper.sextinvl.blog:2096
hermeticwiper.sextinvl.blog:8443

Mutex

cvsyi5kVAmzW

Attributes

delay
0
install
true
install_file
2r8r4efd.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a5a137ab1aabbcd3f9acdf2f409be47488dfa9fc9df6078d3cf2daaebbc9d83

File Explorer

8a5a137ab1aabbcd3f9acdf2f409be47488dfa9fc9df6078d3cf2daaebbc9d83

.exe 45KB

8a5a137ab1aabbcd3f9acdf2f409be47488dfa9fc9df6078d3cf2daaebbc9d83

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8a5a137ab1aabbcd3f9acdf2f409be47488dfa9fc9df6078d3cf2daaebbc9d83
MD5 1c3807f9cb39a36f1ec97350ccb0daf8
SHA1 33d7637102be33d61fcb98a29d5ce755835073d7
SHA512 970601e75663ec9aecb5ce8d3f82878dbda41ff0d79c9a06fc0c468d9f5457f3c3264ce1b86eaf75f6f3e6b427c1ccb5bcef9c8ef50ca17846c65bf63d6bdd78
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA5Bz5U4x7PIgEjb5gX3iwccaqiOlNQJ5ijBDZcx:UuKWgSJTwRf2pj6gEbWXSL5qiYNG52de
TLSH
T178232B003BE8C12BF2BE4FB8ACF26145467AF6636603D5496CC451DB5713BC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

8a5a137ab1aabbcd3f9acdf2f409be47488dfa9fc9df6078d3cf2daaebbc9d83

mscoree

dotnet