asyncrat | 1992842b338cbe286ed9964b55556e8850d727aed8f31873b3f667ccee5700af

Sharing

Copy URL Twitter E-mail

General

Target
1992842b338cbe286ed9964b55556e8850d727aed8f31873b3f667ccee5700af
Size 45KB
Sample260804-wk6bcstyfw
SHA256 1992842b338cbe286ed9964b55556e8850d727aed8f31873b3f667ccee5700af
MD5 7b91a90adff284c310a034f8dbb718bb
SHA1 4aa26e6b9a2003a9ce3917069271e9be0fd17cbd
SHA512 dc7b458a935857439660192602360ed3c3806f54d9d395284bbdc96d0e56a8c6b9152fbf6d675f697090bfde2e86d8bd567ba835d07dc36f9c51999438daf659
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QPCBjPSNjPI/zjb1gX3iyKNNoWMmxsxqBDZsx:EufspTf2g2hO5sMSK/3bSXStNocxtdsx
TLSH
T1DE231A0037E8C12BF2BE4F7898F26145867AF6636603E5492CC452DB5613FC6D642AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xemcliphot.net:80
xemcliphot.net:22
xemcliphot.net:8080
xemcliphot.net:8880
xemcliphot.net:2052
xemcliphot.net:2082
xemcliphot.net:2086
xemcliphot.net:2095
xemcliphot.net:443
xemcliphot.net:2053
xemcliphot.net:2083
xemcliphot.net:2087
xemcliphot.net:2096
xemcliphot.net:8443
www.xemcliphot.net:80
www.xemcliphot.net:22
www.xemcliphot.net:8080
www.xemcliphot.net:8880
www.xemcliphot.net:2052
www.xemcliphot.net:2082
www.xemcliphot.net:2086
www.xemcliphot.net:2095
www.xemcliphot.net:443
www.xemcliphot.net:2053
www.xemcliphot.net:2083
www.xemcliphot.net:2087
www.xemcliphot.net:2096
www.xemcliphot.net:8443
triton.xemcliphot.net:80
triton.xemcliphot.net:22
triton.xemcliphot.net:8080
triton.xemcliphot.net:8880
triton.xemcliphot.net:2052
triton.xemcliphot.net:2082
triton.xemcliphot.net:2086
triton.xemcliphot.net:2095
triton.xemcliphot.net:443
triton.xemcliphot.net:2053
triton.xemcliphot.net:2083
triton.xemcliphot.net:2087
triton.xemcliphot.net:2096
triton.xemcliphot.net:8443
cryptolocker.xemcliphot.net:80
cryptolocker.xemcliphot.net:22
cryptolocker.xemcliphot.net:8080
cryptolocker.xemcliphot.net:8880
cryptolocker.xemcliphot.net:2052
cryptolocker.xemcliphot.net:2082
cryptolocker.xemcliphot.net:2086
cryptolocker.xemcliphot.net:2095
cryptolocker.xemcliphot.net:443
cryptolocker.xemcliphot.net:2053
cryptolocker.xemcliphot.net:2083
cryptolocker.xemcliphot.net:2087
cryptolocker.xemcliphot.net:2096
cryptolocker.xemcliphot.net:8443
sodinokibi.xemcliphot.net:80
sodinokibi.xemcliphot.net:22
sodinokibi.xemcliphot.net:8080
sodinokibi.xemcliphot.net:8880
sodinokibi.xemcliphot.net:2052
sodinokibi.xemcliphot.net:2082
sodinokibi.xemcliphot.net:2086
sodinokibi.xemcliphot.net:2095
sodinokibi.xemcliphot.net:443
sodinokibi.xemcliphot.net:2053
sodinokibi.xemcliphot.net:2083
sodinokibi.xemcliphot.net:2087
sodinokibi.xemcliphot.net:2096
sodinokibi.xemcliphot.net:8443

Mutex

KxRd7s4jv7vC

Attributes

delay
0
install
true
install_file
wigbe6w.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1992842b338cbe286ed9964b55556e8850d727aed8f31873b3f667ccee5700af

File Explorer

1992842b338cbe286ed9964b55556e8850d727aed8f31873b3f667ccee5700af

.exe 45KB

1992842b338cbe286ed9964b55556e8850d727aed8f31873b3f667ccee5700af

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1992842b338cbe286ed9964b55556e8850d727aed8f31873b3f667ccee5700af
MD5 7b91a90adff284c310a034f8dbb718bb
SHA1 4aa26e6b9a2003a9ce3917069271e9be0fd17cbd
SHA512 dc7b458a935857439660192602360ed3c3806f54d9d395284bbdc96d0e56a8c6b9152fbf6d675f697090bfde2e86d8bd567ba835d07dc36f9c51999438daf659
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QPCBjPSNjPI/zjb1gX3iyKNNoWMmxsxqBDZsx:EufspTf2g2hO5sMSK/3bSXStNocxtdsx
TLSH
T1DE231A0037E8C12BF2BE4F7898F26145867AF6636603E5492CC452DB5613FC6D642AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

1992842b338cbe286ed9964b55556e8850d727aed8f31873b3f667ccee5700af

mscoree

dotnet