asyncrat | 520102d1a67674f0b4b7b2f477a4da4f529d112c8bd8cc86e6314d2536849723

Sharing

Copy URL Twitter E-mail

General

Target
520102d1a67674f0b4b7b2f477a4da4f529d112c8bd8cc86e6314d2536849723
Size 45KB
Sample260815-j5devsgr9s
SHA256 520102d1a67674f0b4b7b2f477a4da4f529d112c8bd8cc86e6314d2536849723
MD5 391dd0bcaf07d667c3d10b1803b14551
SHA1 ba931da21935d675c3e1669a218af8b204d41a60
SHA512 161e14b26e19652f473336a530527e36be73a1ea2ca1dfeee3dc34f49688d095582213256b8fc65db8dc2d1984ef5afd6920ad7258991b115c6e8de0d2f8db2c
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1wpt0CCM+d4CvS8PIMxjbqgX3iecUdUxddiJLPfBDZW:cuR0JTPjY2p/CFWBMhb9XSecUgfiJLB0
TLSH
T18C231B003BE9C12BF2BE4F7899F26245467AF5732603D5891CC451DB5A23FC68A43AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

glagbo.com:80
glagbo.com:22
glagbo.com:8080
glagbo.com:8880
glagbo.com:2052
glagbo.com:2082
glagbo.com:2086
glagbo.com:2095
glagbo.com:443
glagbo.com:2053
glagbo.com:2083
glagbo.com:2087
glagbo.com:2096
glagbo.com:8443
www.glagbo.com:80
www.glagbo.com:22
www.glagbo.com:8080
www.glagbo.com:8880
www.glagbo.com:2052
www.glagbo.com:2082
www.glagbo.com:2086
www.glagbo.com:2095
www.glagbo.com:443
www.glagbo.com:2053
www.glagbo.com:2083
www.glagbo.com:2087
www.glagbo.com:2096
www.glagbo.com:8443
client.glagbo.com:80
client.glagbo.com:22
client.glagbo.com:8080
client.glagbo.com:8880
client.glagbo.com:2052
client.glagbo.com:2082
client.glagbo.com:2086
client.glagbo.com:2095
client.glagbo.com:443
client.glagbo.com:2053
client.glagbo.com:2083
client.glagbo.com:2087
client.glagbo.com:2096
client.glagbo.com:8443
mirai.glagbo.com:80
mirai.glagbo.com:22
mirai.glagbo.com:8080
mirai.glagbo.com:8880
mirai.glagbo.com:2052
mirai.glagbo.com:2082
mirai.glagbo.com:2086
mirai.glagbo.com:2095
mirai.glagbo.com:443
mirai.glagbo.com:2053
mirai.glagbo.com:2083
mirai.glagbo.com:2087
mirai.glagbo.com:2096
mirai.glagbo.com:8443
agenttesla.glagbo.com:80
agenttesla.glagbo.com:22
agenttesla.glagbo.com:8080
agenttesla.glagbo.com:8880
agenttesla.glagbo.com:2052
agenttesla.glagbo.com:2082
agenttesla.glagbo.com:2086
agenttesla.glagbo.com:2095
agenttesla.glagbo.com:443
agenttesla.glagbo.com:2053
agenttesla.glagbo.com:2083
agenttesla.glagbo.com:2087
agenttesla.glagbo.com:2096
agenttesla.glagbo.com:8443

Mutex

nWCxoQrzslpq

Attributes

delay
0
install
true
install_file
ch3b.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
520102d1a67674f0b4b7b2f477a4da4f529d112c8bd8cc86e6314d2536849723

File Explorer

520102d1a67674f0b4b7b2f477a4da4f529d112c8bd8cc86e6314d2536849723

.exe 45KB

520102d1a67674f0b4b7b2f477a4da4f529d112c8bd8cc86e6314d2536849723

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 520102d1a67674f0b4b7b2f477a4da4f529d112c8bd8cc86e6314d2536849723
MD5 391dd0bcaf07d667c3d10b1803b14551
SHA1 ba931da21935d675c3e1669a218af8b204d41a60
SHA512 161e14b26e19652f473336a530527e36be73a1ea2ca1dfeee3dc34f49688d095582213256b8fc65db8dc2d1984ef5afd6920ad7258991b115c6e8de0d2f8db2c
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1wpt0CCM+d4CvS8PIMxjbqgX3iecUdUxddiJLPfBDZW:cuR0JTPjY2p/CFWBMhb9XSecUgfiJLB0
TLSH
T18C231B003BE9C12BF2BE4F7899F26245467AF5732603D5891CC451DB5A23FC68A43AF9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

520102d1a67674f0b4b7b2f477a4da4f529d112c8bd8cc86e6314d2536849723

mscoree

dotnet