asyncrat | eaab52f922929321608d1b43004b0388509a1c0a5f8021e3e70c65de63ac035a

Sharing

Copy URL Twitter E-mail

General

Target
eaab52f922929321608d1b43004b0388509a1c0a5f8021e3e70c65de63ac035a
Size 45KB
Sample260813-nrdwpaxvbx
SHA256 eaab52f922929321608d1b43004b0388509a1c0a5f8021e3e70c65de63ac035a
MD5 5bbb46b0e9dc2f29301c2a54b89cfeee
SHA1 be272d8a0f3331b393cdd26c1b9b344f45361d32
SHA512 6e4718596b682ec431dc7820ff7749d33404c3d59d633bcc4ed6d6f0c77f6d3e9a95050f494883621403b6669e2ef1e3fb7fb096626ef0a032793d69993c56a9
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/rLzlJAOPIc6zjbVgXeiUD++L8HQmMBe/a0tsueBc:EulCJTHl42ePp23c63byXnUH8HHMBe5R
TLSH
T13F231B003BD8C12BF2BF4F7898F26145867EF6673A03D58A1CC4519B5613FC69A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

glagbo.com:80
glagbo.com:22
glagbo.com:8080
glagbo.com:8880
glagbo.com:2052
glagbo.com:2082
glagbo.com:2086
glagbo.com:2095
glagbo.com:443
glagbo.com:2053
glagbo.com:2083
glagbo.com:2087
glagbo.com:2096
glagbo.com:8443
www.glagbo.com:80
www.glagbo.com:22
www.glagbo.com:8080
www.glagbo.com:8880
www.glagbo.com:2052
www.glagbo.com:2082
www.glagbo.com:2086
www.glagbo.com:2095
www.glagbo.com:443
www.glagbo.com:2053
www.glagbo.com:2083
www.glagbo.com:2087
www.glagbo.com:2096
www.glagbo.com:8443
melissa.glagbo.com:80
melissa.glagbo.com:22
melissa.glagbo.com:8080
melissa.glagbo.com:8880
melissa.glagbo.com:2052
melissa.glagbo.com:2082
melissa.glagbo.com:2086
melissa.glagbo.com:2095
melissa.glagbo.com:443
melissa.glagbo.com:2053
melissa.glagbo.com:2083
melissa.glagbo.com:2087
melissa.glagbo.com:2096
melissa.glagbo.com:8443
cl0p.glagbo.com:80
cl0p.glagbo.com:22
cl0p.glagbo.com:8080
cl0p.glagbo.com:8880
cl0p.glagbo.com:2052
cl0p.glagbo.com:2082
cl0p.glagbo.com:2086
cl0p.glagbo.com:2095
cl0p.glagbo.com:443
cl0p.glagbo.com:2053
cl0p.glagbo.com:2083
cl0p.glagbo.com:2087
cl0p.glagbo.com:2096
cl0p.glagbo.com:8443
downadup.glagbo.com:80
downadup.glagbo.com:22
downadup.glagbo.com:8080
downadup.glagbo.com:8880
downadup.glagbo.com:2052
downadup.glagbo.com:2082
downadup.glagbo.com:2086
downadup.glagbo.com:2095
downadup.glagbo.com:443
downadup.glagbo.com:2053
downadup.glagbo.com:2083
downadup.glagbo.com:2087
downadup.glagbo.com:2096
downadup.glagbo.com:8443
nimda.glagbo.com:80
nimda.glagbo.com:22
nimda.glagbo.com:8080
nimda.glagbo.com:8880
nimda.glagbo.com:2052
nimda.glagbo.com:2082
nimda.glagbo.com:2086
nimda.glagbo.com:2095
nimda.glagbo.com:443
nimda.glagbo.com:2053
nimda.glagbo.com:2083
nimda.glagbo.com:2087
nimda.glagbo.com:2096
nimda.glagbo.com:8443

Mutex

GcrqRCTEmJ50

Attributes

delay
0
install
true
install_file
3cv72p.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eaab52f922929321608d1b43004b0388509a1c0a5f8021e3e70c65de63ac035a

File Explorer

eaab52f922929321608d1b43004b0388509a1c0a5f8021e3e70c65de63ac035a

.exe 45KB

eaab52f922929321608d1b43004b0388509a1c0a5f8021e3e70c65de63ac035a

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 eaab52f922929321608d1b43004b0388509a1c0a5f8021e3e70c65de63ac035a
MD5 5bbb46b0e9dc2f29301c2a54b89cfeee
SHA1 be272d8a0f3331b393cdd26c1b9b344f45361d32
SHA512 6e4718596b682ec431dc7820ff7749d33404c3d59d633bcc4ed6d6f0c77f6d3e9a95050f494883621403b6669e2ef1e3fb7fb096626ef0a032793d69993c56a9
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/rLzlJAOPIc6zjbVgXeiUD++L8HQmMBe/a0tsueBc:EulCJTHl42ePp23c63byXnUH8HHMBe5R
TLSH
T13F231B003BD8C12BF2BF4F7898F26145867EF6673A03D58A1CC4519B5613FC69A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

eaab52f922929321608d1b43004b0388509a1c0a5f8021e3e70c65de63ac035a

mscoree

dotnet