asyncrat | 31ff174a8ca9b0817f76fffea806e6367ae4968a5cc77bbfcca4c16cfd158848

Sharing

Copy URL Twitter E-mail

General

Target
31ff174a8ca9b0817f76fffea806e6367ae4968a5cc77bbfcca4c16cfd158848
Size 45KB
Sample260804-v2sk6attd1
SHA256 31ff174a8ca9b0817f76fffea806e6367ae4968a5cc77bbfcca4c16cfd158848
MD5 dab3a6148ab304a35c39632a3cb409ef
SHA1 4e6de9805f404aed79265c34d862142e34305d35
SHA512 6551f444dc5fccd63c82c2ee01e28cc6352e29cafd38edcac84177e283102d5e4486979701931295fce8e564751073f38ac6b1fa7bb31ae7059a301c6653dcd1
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAHBjusyQowsPIWzjbDgX3Z8kbrJYKArNBDZMx:kuSOpTPOP2XBjuxZwRW3bcXJ8k/4/dMx
TLSH
T10B232B003BE9C13BF2BE4F7899F26145867AB2632603D54E1CC441DB5623FC69A826FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

pod8ca.top:80
pod8ca.top:22
pod8ca.top:8080
pod8ca.top:8880
pod8ca.top:2052
pod8ca.top:2082
pod8ca.top:2086
pod8ca.top:2095
pod8ca.top:443
pod8ca.top:2053
pod8ca.top:2083
pod8ca.top:2087
pod8ca.top:2096
pod8ca.top:8443
www.pod8ca.top:80
www.pod8ca.top:22
www.pod8ca.top:8080
www.pod8ca.top:8880
www.pod8ca.top:2052
www.pod8ca.top:2082
www.pod8ca.top:2086
www.pod8ca.top:2095
www.pod8ca.top:443
www.pod8ca.top:2053
www.pod8ca.top:2083
www.pod8ca.top:2087
www.pod8ca.top:2096
www.pod8ca.top:8443
cryptolocker.pod8ca.top:80
cryptolocker.pod8ca.top:22
cryptolocker.pod8ca.top:8080
cryptolocker.pod8ca.top:8880
cryptolocker.pod8ca.top:2052
cryptolocker.pod8ca.top:2082
cryptolocker.pod8ca.top:2086
cryptolocker.pod8ca.top:2095
cryptolocker.pod8ca.top:443
cryptolocker.pod8ca.top:2053
cryptolocker.pod8ca.top:2083
cryptolocker.pod8ca.top:2087
cryptolocker.pod8ca.top:2096
cryptolocker.pod8ca.top:8443
melissa.pod8ca.top:80
melissa.pod8ca.top:22
melissa.pod8ca.top:8080
melissa.pod8ca.top:8880
melissa.pod8ca.top:2052
melissa.pod8ca.top:2082
melissa.pod8ca.top:2086
melissa.pod8ca.top:2095
melissa.pod8ca.top:443
melissa.pod8ca.top:2053
melissa.pod8ca.top:2083
melissa.pod8ca.top:2087
melissa.pod8ca.top:2096
melissa.pod8ca.top:8443
blacklotus.pod8ca.top:80
blacklotus.pod8ca.top:22
blacklotus.pod8ca.top:8080
blacklotus.pod8ca.top:8880
blacklotus.pod8ca.top:2052
blacklotus.pod8ca.top:2082
blacklotus.pod8ca.top:2086
blacklotus.pod8ca.top:2095
blacklotus.pod8ca.top:443
blacklotus.pod8ca.top:2053
blacklotus.pod8ca.top:2083
blacklotus.pod8ca.top:2087
blacklotus.pod8ca.top:2096
blacklotus.pod8ca.top:8443
gootloader.pod8ca.top:80
gootloader.pod8ca.top:22
gootloader.pod8ca.top:8080
gootloader.pod8ca.top:8880
gootloader.pod8ca.top:2052
gootloader.pod8ca.top:2082
gootloader.pod8ca.top:2086
gootloader.pod8ca.top:2095
gootloader.pod8ca.top:443
gootloader.pod8ca.top:2053
gootloader.pod8ca.top:2083
gootloader.pod8ca.top:2087
gootloader.pod8ca.top:2096
gootloader.pod8ca.top:8443

Mutex

CxShO8eZno9s

Attributes

delay
0
install
true
install_file
at5s.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31ff174a8ca9b0817f76fffea806e6367ae4968a5cc77bbfcca4c16cfd158848

File Explorer

31ff174a8ca9b0817f76fffea806e6367ae4968a5cc77bbfcca4c16cfd158848

.exe 45KB

31ff174a8ca9b0817f76fffea806e6367ae4968a5cc77bbfcca4c16cfd158848

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 31ff174a8ca9b0817f76fffea806e6367ae4968a5cc77bbfcca4c16cfd158848
MD5 dab3a6148ab304a35c39632a3cb409ef
SHA1 4e6de9805f404aed79265c34d862142e34305d35
SHA512 6551f444dc5fccd63c82c2ee01e28cc6352e29cafd38edcac84177e283102d5e4486979701931295fce8e564751073f38ac6b1fa7bb31ae7059a301c6653dcd1
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAHBjusyQowsPIWzjbDgX3Z8kbrJYKArNBDZMx:kuSOpTPOP2XBjuxZwRW3bcXJ8k/4/dMx
TLSH
T10B232B003BE9C13BF2BE4F7899F26145867AB2632603D54E1CC441DB5623FC69A826FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

31ff174a8ca9b0817f76fffea806e6367ae4968a5cc77bbfcca4c16cfd158848

mscoree

dotnet