asyncrat | c9f79973036ddfc3f5e0ee51b3da7d81e330e0292da03a575b1374c525b91dab

Sharing

Copy URL Twitter E-mail

General

Target
c9f79973036ddfc3f5e0ee51b3da7d81e330e0292da03a575b1374c525b91dab
Size 45KB
Sample260804-yzlllsdn5y
SHA256 c9f79973036ddfc3f5e0ee51b3da7d81e330e0292da03a575b1374c525b91dab
MD5 1deca83a8168de1ae66a43e1b94f5e74
SHA1 382ba1a50cec516fd588a851f33202b851ceaa99
SHA512 35c821982399dbc3d1190cd5f99d1fe2bf93fe8eb33b0050c6493a430c4d621cbaab55c7892d9dc6e4f8d2f2ae7e8d038eed4d3da62dc4cc586837aa7689d1b1
SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1V8V1RpPEcPIMzjbjgX3i7kKovTq692GvCNdi/8BDo:wuZ8pT1tc2W8VDZEhM3b8XS7kKov2uJH
TLSH
T154232A003BE9822BF1BE4F789DF26145467AF2672603E54E1CC441DB5623FC69A826FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

qmh.buzz:80
qmh.buzz:22
qmh.buzz:8080
qmh.buzz:8880
qmh.buzz:2052
qmh.buzz:2082
qmh.buzz:2086
qmh.buzz:2095
qmh.buzz:443
qmh.buzz:2053
qmh.buzz:2083
qmh.buzz:2087
qmh.buzz:2096
qmh.buzz:8443
www.qmh.buzz:80
www.qmh.buzz:22
www.qmh.buzz:8080
www.qmh.buzz:8880
www.qmh.buzz:2052
www.qmh.buzz:2082
www.qmh.buzz:2086
www.qmh.buzz:2095
www.qmh.buzz:443
www.qmh.buzz:2053
www.qmh.buzz:2083
www.qmh.buzz:2087
www.qmh.buzz:2096
www.qmh.buzz:8443
wannacry.qmh.buzz:80
wannacry.qmh.buzz:22
wannacry.qmh.buzz:8080
wannacry.qmh.buzz:8880
wannacry.qmh.buzz:2052
wannacry.qmh.buzz:2082
wannacry.qmh.buzz:2086
wannacry.qmh.buzz:2095
wannacry.qmh.buzz:443
wannacry.qmh.buzz:2053
wannacry.qmh.buzz:2083
wannacry.qmh.buzz:2087
wannacry.qmh.buzz:2096
wannacry.qmh.buzz:8443
gozi.qmh.buzz:80
gozi.qmh.buzz:22
gozi.qmh.buzz:8080
gozi.qmh.buzz:8880
gozi.qmh.buzz:2052
gozi.qmh.buzz:2082
gozi.qmh.buzz:2086
gozi.qmh.buzz:2095
gozi.qmh.buzz:443
gozi.qmh.buzz:2053
gozi.qmh.buzz:2083
gozi.qmh.buzz:2087
gozi.qmh.buzz:2096
gozi.qmh.buzz:8443
qakbot.qmh.buzz:80
qakbot.qmh.buzz:22
qakbot.qmh.buzz:8080
qakbot.qmh.buzz:8880
qakbot.qmh.buzz:2052
qakbot.qmh.buzz:2082
qakbot.qmh.buzz:2086
qakbot.qmh.buzz:2095
qakbot.qmh.buzz:443
qakbot.qmh.buzz:2053
qakbot.qmh.buzz:2083
qakbot.qmh.buzz:2087
qakbot.qmh.buzz:2096
qakbot.qmh.buzz:8443

Mutex

Y3j4Bwna03Rl

Attributes

delay
0
install
true
install_file
l5mu.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9f79973036ddfc3f5e0ee51b3da7d81e330e0292da03a575b1374c525b91dab

File Explorer

c9f79973036ddfc3f5e0ee51b3da7d81e330e0292da03a575b1374c525b91dab

.exe 45KB

c9f79973036ddfc3f5e0ee51b3da7d81e330e0292da03a575b1374c525b91dab

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c9f79973036ddfc3f5e0ee51b3da7d81e330e0292da03a575b1374c525b91dab
MD5 1deca83a8168de1ae66a43e1b94f5e74
SHA1 382ba1a50cec516fd588a851f33202b851ceaa99
SHA512 35c821982399dbc3d1190cd5f99d1fe2bf93fe8eb33b0050c6493a430c4d621cbaab55c7892d9dc6e4f8d2f2ae7e8d038eed4d3da62dc4cc586837aa7689d1b1
SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1V8V1RpPEcPIMzjbjgX3i7kKovTq692GvCNdi/8BDo:wuZ8pT1tc2W8VDZEhM3b8XS7kKov2uJH
TLSH
T154232A003BE9822BF1BE4F789DF26145467AF2672603E54E1CC441DB5623FC69A826FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c9f79973036ddfc3f5e0ee51b3da7d81e330e0292da03a575b1374c525b91dab

mscoree

dotnet