asyncrat | 15204eb4bf67483f3df1beb5c9678f89ba1003bcbb31e19187b9fcbcbacd15ba

Sharing

Copy URL Twitter E-mail

General

Target
15204eb4bf67483f3df1beb5c9678f89ba1003bcbb31e19187b9fcbcbacd15ba
Size 45KB
Sample260814-l3teea1bkh
SHA256 15204eb4bf67483f3df1beb5c9678f89ba1003bcbb31e19187b9fcbcbacd15ba
MD5 aa3b3553b7e53e7a4d3e76fb0524abb5
SHA1 06dc702daafea37c040db808a23a512385a0ccfb
SHA512 b040562e712edaeb19cccb3f8bc2c48d88037fd8221917b1e7cd26620bf137f64971a457db45a8b4446e64774ee53566f7750e91621774382d00fd27a358ff5a
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9FO5QPCBjPSNjPI/zjbggX3i6sHX+mYZBDZ8x:0uPrpT/qY2UO5sMSK/3bHXS6mX1YHd8x
TLSH
T189233D003BE8812BF2BF4F78A9F22145467AF6637603D5492CC451DB5613FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

glagbo.com:80
glagbo.com:22
glagbo.com:8080
glagbo.com:8880
glagbo.com:2052
glagbo.com:2082
glagbo.com:2086
glagbo.com:2095
glagbo.com:443
glagbo.com:2053
glagbo.com:2083
glagbo.com:2087
glagbo.com:2096
glagbo.com:8443
www.glagbo.com:80
www.glagbo.com:22
www.glagbo.com:8080
www.glagbo.com:8880
www.glagbo.com:2052
www.glagbo.com:2082
www.glagbo.com:2086
www.glagbo.com:2095
www.glagbo.com:443
www.glagbo.com:2053
www.glagbo.com:2083
www.glagbo.com:2087
www.glagbo.com:2096
www.glagbo.com:8443
downadup.glagbo.com:80
downadup.glagbo.com:22
downadup.glagbo.com:8080
downadup.glagbo.com:8880
downadup.glagbo.com:2052
downadup.glagbo.com:2082
downadup.glagbo.com:2086
downadup.glagbo.com:2095
downadup.glagbo.com:443
downadup.glagbo.com:2053
downadup.glagbo.com:2083
downadup.glagbo.com:2087
downadup.glagbo.com:2096
downadup.glagbo.com:8443
fakeupdates.glagbo.com:80
fakeupdates.glagbo.com:22
fakeupdates.glagbo.com:8080
fakeupdates.glagbo.com:8880
fakeupdates.glagbo.com:2052
fakeupdates.glagbo.com:2082
fakeupdates.glagbo.com:2086
fakeupdates.glagbo.com:2095
fakeupdates.glagbo.com:443
fakeupdates.glagbo.com:2053
fakeupdates.glagbo.com:2083
fakeupdates.glagbo.com:2087
fakeupdates.glagbo.com:2096
fakeupdates.glagbo.com:8443
iloveyou.glagbo.com:80
iloveyou.glagbo.com:22
iloveyou.glagbo.com:8080
iloveyou.glagbo.com:8880
iloveyou.glagbo.com:2052
iloveyou.glagbo.com:2082
iloveyou.glagbo.com:2086
iloveyou.glagbo.com:2095
iloveyou.glagbo.com:443
iloveyou.glagbo.com:2053
iloveyou.glagbo.com:2083
iloveyou.glagbo.com:2087
iloveyou.glagbo.com:2096
iloveyou.glagbo.com:8443

Mutex

FbH2EILIG5Dv

Attributes

delay
0
install
true
install_file
i74ywew.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15204eb4bf67483f3df1beb5c9678f89ba1003bcbb31e19187b9fcbcbacd15ba

File Explorer

15204eb4bf67483f3df1beb5c9678f89ba1003bcbb31e19187b9fcbcbacd15ba

.exe 45KB

15204eb4bf67483f3df1beb5c9678f89ba1003bcbb31e19187b9fcbcbacd15ba

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 15204eb4bf67483f3df1beb5c9678f89ba1003bcbb31e19187b9fcbcbacd15ba
MD5 aa3b3553b7e53e7a4d3e76fb0524abb5
SHA1 06dc702daafea37c040db808a23a512385a0ccfb
SHA512 b040562e712edaeb19cccb3f8bc2c48d88037fd8221917b1e7cd26620bf137f64971a457db45a8b4446e64774ee53566f7750e91621774382d00fd27a358ff5a
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9FO5QPCBjPSNjPI/zjbggX3i6sHX+mYZBDZ8x:0uPrpT/qY2UO5sMSK/3bHXS6mX1YHd8x
TLSH
T189233D003BE8812BF2BF4F78A9F22145467AF6637603D5492CC451DB5613FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

15204eb4bf67483f3df1beb5c9678f89ba1003bcbb31e19187b9fcbcbacd15ba

mscoree

dotnet