asyncrat | 51a9ecc5ef770afbb8324a609fbe2407baddc1cf9c3491953d96ad6ca606eb62

Sharing

Copy URL Twitter E-mail

General

Target
51a9ecc5ef770afbb8324a609fbe2407baddc1cf9c3491953d96ad6ca606eb62
Size 45KB
Sample260804-vy3lysap91
SHA256 51a9ecc5ef770afbb8324a609fbe2407baddc1cf9c3491953d96ad6ca606eb62
MD5 946b73f46f0cff75f914747900e827e2
SHA1 71459f36b83a9ae88b8939113bd168be3e7c6857
SHA512 041f3dfe8bca59fd69d7ecaadb4a6c869abc24a2627fb1559f7a171954845d1a4014b953069b1d228d1ef80f9bc1cc4cfe90f33aa196b906e4ac719e98be695c
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qA2Q0u3+/vPPjZPIvzjbfgM3i16P48mwrVxWEv/7u2:cuqNJTLr62mi32/jWv3boMS8PTlDxDg0
TLSH
T1E1232B003BE9812BF2BE4F78A9F26145867BB6633A03D5491CC451DB5713FC6CA42AED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexvietnam.com:80
fimsexvietnam.com:22
fimsexvietnam.com:8080
fimsexvietnam.com:8880
fimsexvietnam.com:2052
fimsexvietnam.com:2082
fimsexvietnam.com:2086
fimsexvietnam.com:2095
fimsexvietnam.com:443
fimsexvietnam.com:2053
fimsexvietnam.com:2083
fimsexvietnam.com:2087
fimsexvietnam.com:2096
fimsexvietnam.com:8443
www.fimsexvietnam.com:80
www.fimsexvietnam.com:22
www.fimsexvietnam.com:8080
www.fimsexvietnam.com:8880
www.fimsexvietnam.com:2052
www.fimsexvietnam.com:2082
www.fimsexvietnam.com:2086
www.fimsexvietnam.com:2095
www.fimsexvietnam.com:443
www.fimsexvietnam.com:2053
www.fimsexvietnam.com:2083
www.fimsexvietnam.com:2087
www.fimsexvietnam.com:2096
www.fimsexvietnam.com:8443
zeus.fimsexvietnam.com:80
zeus.fimsexvietnam.com:22
zeus.fimsexvietnam.com:8080
zeus.fimsexvietnam.com:8880
zeus.fimsexvietnam.com:2052
zeus.fimsexvietnam.com:2082
zeus.fimsexvietnam.com:2086
zeus.fimsexvietnam.com:2095
zeus.fimsexvietnam.com:443
zeus.fimsexvietnam.com:2053
zeus.fimsexvietnam.com:2083
zeus.fimsexvietnam.com:2087
zeus.fimsexvietnam.com:2096
zeus.fimsexvietnam.com:8443
industroyer.fimsexvietnam.com:80
industroyer.fimsexvietnam.com:22
industroyer.fimsexvietnam.com:8080
industroyer.fimsexvietnam.com:8880
industroyer.fimsexvietnam.com:2052
industroyer.fimsexvietnam.com:2082
industroyer.fimsexvietnam.com:2086
industroyer.fimsexvietnam.com:2095
industroyer.fimsexvietnam.com:443
industroyer.fimsexvietnam.com:2053
industroyer.fimsexvietnam.com:2083
industroyer.fimsexvietnam.com:2087
industroyer.fimsexvietnam.com:2096
industroyer.fimsexvietnam.com:8443
triton.fimsexvietnam.com:80
triton.fimsexvietnam.com:22
triton.fimsexvietnam.com:8080
triton.fimsexvietnam.com:8880
triton.fimsexvietnam.com:2052
triton.fimsexvietnam.com:2082
triton.fimsexvietnam.com:2086
triton.fimsexvietnam.com:2095
triton.fimsexvietnam.com:443
triton.fimsexvietnam.com:2053
triton.fimsexvietnam.com:2083
triton.fimsexvietnam.com:2087
triton.fimsexvietnam.com:2096
triton.fimsexvietnam.com:8443
azorult.fimsexvietnam.com:80
azorult.fimsexvietnam.com:22
azorult.fimsexvietnam.com:8080
azorult.fimsexvietnam.com:8880
azorult.fimsexvietnam.com:2052
azorult.fimsexvietnam.com:2082
azorult.fimsexvietnam.com:2086
azorult.fimsexvietnam.com:2095
azorult.fimsexvietnam.com:443
azorult.fimsexvietnam.com:2053
azorult.fimsexvietnam.com:2083
azorult.fimsexvietnam.com:2087
azorult.fimsexvietnam.com:2096
azorult.fimsexvietnam.com:8443

Mutex

jNSt8KnSSSWo

Attributes

delay
0
install
true
install_file
tbtm.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51a9ecc5ef770afbb8324a609fbe2407baddc1cf9c3491953d96ad6ca606eb62

File Explorer

51a9ecc5ef770afbb8324a609fbe2407baddc1cf9c3491953d96ad6ca606eb62

.exe 45KB

51a9ecc5ef770afbb8324a609fbe2407baddc1cf9c3491953d96ad6ca606eb62

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 51a9ecc5ef770afbb8324a609fbe2407baddc1cf9c3491953d96ad6ca606eb62
MD5 946b73f46f0cff75f914747900e827e2
SHA1 71459f36b83a9ae88b8939113bd168be3e7c6857
SHA512 041f3dfe8bca59fd69d7ecaadb4a6c869abc24a2627fb1559f7a171954845d1a4014b953069b1d228d1ef80f9bc1cc4cfe90f33aa196b906e4ac719e98be695c
SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qA2Q0u3+/vPPjZPIvzjbfgM3i16P48mwrVxWEv/7u2:cuqNJTLr62mi32/jWv3boMS8PTlDxDg0
TLSH
T1E1232B003BE9812BF2BE4F78A9F26145867BB6633A03D5491CC451DB5713FC6CA42AED
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

51a9ecc5ef770afbb8324a609fbe2407baddc1cf9c3491953d96ad6ca606eb62

mscoree

dotnet