asyncrat | 4abd23c442eb0a08abce66fe4fff9726eedf7703663517abc9dc016116484158

Sharing

Copy URL Twitter E-mail

General

Target
4abd23c442eb0a08abce66fe4fff9726eedf7703663517abc9dc016116484158
Size 45KB
Sample260804-zjbbdaxyex
SHA256 4abd23c442eb0a08abce66fe4fff9726eedf7703663517abc9dc016116484158
MD5 e51a68efdb188a83751ff83acf26df09
SHA1 d5582fee7fc54fa780addbd1c4135462bdf50e75
SHA512 45f5b05bfdaa4672d9c8ae818278ee3de512033f7a9e9aed5c224f8a52ee3a8ec382b52bbe279df716eac3082b6796756a4535dcc3bb7745ea883a77fdae81fc
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVD0ewUkA1MiZPI7zjbhg43iPWPsOfqOaBDZEx:MuBGJTPho2iwvDiW73bO4S+PsDbdEx
TLSH
T1FE231A003BE9812BF2BE4F7898F26145867AF6632603D5491CC451DB5623FC6DA43AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

qmh.buzz:80
qmh.buzz:22
qmh.buzz:8080
qmh.buzz:8880
qmh.buzz:2052
qmh.buzz:2082
qmh.buzz:2086
qmh.buzz:2095
qmh.buzz:443
qmh.buzz:2053
qmh.buzz:2083
qmh.buzz:2087
qmh.buzz:2096
qmh.buzz:8443
www.qmh.buzz:80
www.qmh.buzz:22
www.qmh.buzz:8080
www.qmh.buzz:8880
www.qmh.buzz:2052
www.qmh.buzz:2082
www.qmh.buzz:2086
www.qmh.buzz:2095
www.qmh.buzz:443
www.qmh.buzz:2053
www.qmh.buzz:2083
www.qmh.buzz:2087
www.qmh.buzz:2096
www.qmh.buzz:8443
fakeupdates.qmh.buzz:80
fakeupdates.qmh.buzz:22
fakeupdates.qmh.buzz:8080
fakeupdates.qmh.buzz:8880
fakeupdates.qmh.buzz:2052
fakeupdates.qmh.buzz:2082
fakeupdates.qmh.buzz:2086
fakeupdates.qmh.buzz:2095
fakeupdates.qmh.buzz:443
fakeupdates.qmh.buzz:2053
fakeupdates.qmh.buzz:2083
fakeupdates.qmh.buzz:2087
fakeupdates.qmh.buzz:2096
fakeupdates.qmh.buzz:8443
blacklotus.qmh.buzz:80
blacklotus.qmh.buzz:22
blacklotus.qmh.buzz:8080
blacklotus.qmh.buzz:8880
blacklotus.qmh.buzz:2052
blacklotus.qmh.buzz:2082
blacklotus.qmh.buzz:2086
blacklotus.qmh.buzz:2095
blacklotus.qmh.buzz:443
blacklotus.qmh.buzz:2053
blacklotus.qmh.buzz:2083
blacklotus.qmh.buzz:2087
blacklotus.qmh.buzz:2096
blacklotus.qmh.buzz:8443
cryptolocker.qmh.buzz:80
cryptolocker.qmh.buzz:22
cryptolocker.qmh.buzz:8080
cryptolocker.qmh.buzz:8880
cryptolocker.qmh.buzz:2052
cryptolocker.qmh.buzz:2082
cryptolocker.qmh.buzz:2086
cryptolocker.qmh.buzz:2095
cryptolocker.qmh.buzz:443
cryptolocker.qmh.buzz:2053
cryptolocker.qmh.buzz:2083
cryptolocker.qmh.buzz:2087
cryptolocker.qmh.buzz:2096
cryptolocker.qmh.buzz:8443
darkside.qmh.buzz:80
darkside.qmh.buzz:22
darkside.qmh.buzz:8080
darkside.qmh.buzz:8880
darkside.qmh.buzz:2052
darkside.qmh.buzz:2082
darkside.qmh.buzz:2086
darkside.qmh.buzz:2095
darkside.qmh.buzz:443
darkside.qmh.buzz:2053
darkside.qmh.buzz:2083
darkside.qmh.buzz:2087
darkside.qmh.buzz:2096
darkside.qmh.buzz:8443

Mutex

sHMAWaZifMvm

Attributes

delay
0
install
true
install_file
j9jh.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4abd23c442eb0a08abce66fe4fff9726eedf7703663517abc9dc016116484158

File Explorer

4abd23c442eb0a08abce66fe4fff9726eedf7703663517abc9dc016116484158

.exe 45KB

4abd23c442eb0a08abce66fe4fff9726eedf7703663517abc9dc016116484158

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4abd23c442eb0a08abce66fe4fff9726eedf7703663517abc9dc016116484158
MD5 e51a68efdb188a83751ff83acf26df09
SHA1 d5582fee7fc54fa780addbd1c4135462bdf50e75
SHA512 45f5b05bfdaa4672d9c8ae818278ee3de512033f7a9e9aed5c224f8a52ee3a8ec382b52bbe279df716eac3082b6796756a4535dcc3bb7745ea883a77fdae81fc
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVD0ewUkA1MiZPI7zjbhg43iPWPsOfqOaBDZEx:MuBGJTPho2iwvDiW73bO4S+PsDbdEx
TLSH
T1FE231A003BE9812BF2BE4F7898F26145867AF6632603D5491CC451DB5623FC6DA43AFD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

4abd23c442eb0a08abce66fe4fff9726eedf7703663517abc9dc016116484158

mscoree

dotnet