asyncrat | mko1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mko1.exe
Size 45KB
Sample260814-c8rnbsbl31
SHA256 191ed0da8d313d6e48bbdfb0ef0cb5210948a778ea8e4ec87863a6febd588fec
MD5 19dde6aedfe451215d10788c0bd39908
SHA1 b8356147ccef462eb24746d784f8f40cb804404b
SHA512 16657bdbf5460fbd14396d57aac0abb41fc24332b7cc3dafb2d4f6c50a659497a6cd02f998bbbbe1b2d1f44c89da6f08b5d6a275d295013aca5e92ca5d668990
SSDEEP 768:suhgJTP0FU0WU2j2Cmo2qVIqyE0OFUwdexIkDPIdzjb0gX3iZJ6QjRTp1VBDZkx:suhgJTPOY2BqNTwMd3bbXSX6uT17dkx
TLSH
T127232A0037E9C22BF2BE4F7469F26141867AF6632603D6491CC451DB5B23BC6DA426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

watchfriendsonline.co/vi-vn/:80
watchfriendsonline.co/vi-vn/:8080
watchfriendsonline.co/vi-vn/:443
watchfriendsonline.co/vi-vn/:8443
watchfriendsonline.co/vi-vn/:6606
watchfriendsonline.co/vi-vn/:22
tutoriapps.net/:80
tutoriapps.net/:8080
tutoriapps.net/:443
tutoriapps.net/:8443
tutoriapps.net/:6606
tutoriapps.net/:22
vodka-fun.buzz/:80
vodka-fun.buzz/:8080
vodka-fun.buzz/:443
vodka-fun.buzz/:8443
vodka-fun.buzz/:6606
vodka-fun.buzz/:22
lyricsglory.in/:80
lyricsglory.in/:8080
lyricsglory.in/:443
lyricsglory.in/:8443
lyricsglory.in/:6606
lyricsglory.in/:22
crow789slot.co/:80
crow789slot.co/:8080
crow789slot.co/:443
crow789slot.co/:8443
crow789slot.co/:6606
crow789slot.co/:22
hashlucky777.io/:80
hashlucky777.io/:8080
hashlucky777.io/:443
hashlucky777.io/:8443
hashlucky777.io/:6606
hashlucky777.io/:22
789winbar.com/:80
789winbar.com/:8080
789winbar.com/:443
789winbar.com/:8443
789winbar.com/:6606
789winbar.com/:22
789win01.dev/:80
789win01.dev/:8080
789win01.dev/:443
789win01.dev/:8443
789win01.dev/:6606
789win01.dev/:22

Mutex

Eer5AzcVy5Bg

Attributes

delay
3
install
false
install_file
GoogleUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mko1.exe

File Explorer

mko1.exe

.exe 45KB

mko1.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 191ed0da8d313d6e48bbdfb0ef0cb5210948a778ea8e4ec87863a6febd588fec
MD5 19dde6aedfe451215d10788c0bd39908
SHA1 b8356147ccef462eb24746d784f8f40cb804404b
SHA512 16657bdbf5460fbd14396d57aac0abb41fc24332b7cc3dafb2d4f6c50a659497a6cd02f998bbbbe1b2d1f44c89da6f08b5d6a275d295013aca5e92ca5d668990
SSDEEP 768:suhgJTP0FU0WU2j2Cmo2qVIqyE0OFUwdexIkDPIdzjb0gX3iZJ6QjRTp1VBDZkx:suhgJTPOY2BqNTwMd3bbXSX6uT17dkx
TLSH
T127232A0037E9C22BF2BE4F7469F26141867AF6632603D6491CC451DB5B23BC6DA426EE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mko1.exe

mscoree

dotnet