asyncrat | 956a777bb0a6355467d23c625f595a287c38833d70442d650f072e33e15f8719

Sharing

Copy URL Twitter E-mail

General

Target
956a777bb0a6355467d23c625f595a287c38833d70442d650f072e33e15f8719
Size 45KB
Sample260831-tsqvjayvas
SHA256 956a777bb0a6355467d23c625f595a287c38833d70442d650f072e33e15f8719
MD5 a91bc10d06d08a7cd7d55ca92a99045e
SHA1 3f66ccf5622ce9d56adeb9c89bc542744f09ffb5
SHA512 dca25680d5b6ef9eb601ec5e71bf9ca33290ea467124bd9351138131b2c609e25e67d7ba7ced3de92638ff70ca7802dd0be3bbf3ff3230a4f06d5135d211b9b3
SSDEEP 768:7uCIJTQc5fVWUhxlDmo2qrn+GtCVnJtHuPI+zjb4gX3iORfYlvk6qTKBDZkx:7uCIJTQmX2q+TB3+3bvXSOpYlvk6qwdm
TLSH
T17E232A0037E8862BF2BE4FB899F26145867AF2633603D54D2CC451D75623FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsexhaymoa.com:80
phimsexhaymoa.com:22
phimsexhaymoa.com:8080
phimsexhaymoa.com:8880
phimsexhaymoa.com:2052
phimsexhaymoa.com:2082
phimsexhaymoa.com:2086
phimsexhaymoa.com:2095
phimsexhaymoa.com:443
phimsexhaymoa.com:2053
phimsexhaymoa.com:2083
phimsexhaymoa.com:2087
phimsexhaymoa.com:2096
phimsexhaymoa.com:8443
www.phimsexhaymoa.com:80
www.phimsexhaymoa.com:22
www.phimsexhaymoa.com:8080
www.phimsexhaymoa.com:8880
www.phimsexhaymoa.com:2052
www.phimsexhaymoa.com:2082
www.phimsexhaymoa.com:2086
www.phimsexhaymoa.com:2095
www.phimsexhaymoa.com:443
www.phimsexhaymoa.com:2053
www.phimsexhaymoa.com:2083
www.phimsexhaymoa.com:2087
www.phimsexhaymoa.com:2096
www.phimsexhaymoa.com:8443
fakeupdates.phimsexhaymoa.com:80
fakeupdates.phimsexhaymoa.com:22
fakeupdates.phimsexhaymoa.com:8080
fakeupdates.phimsexhaymoa.com:8880
fakeupdates.phimsexhaymoa.com:2052
fakeupdates.phimsexhaymoa.com:2082
fakeupdates.phimsexhaymoa.com:2086
fakeupdates.phimsexhaymoa.com:2095
fakeupdates.phimsexhaymoa.com:443
fakeupdates.phimsexhaymoa.com:2053
fakeupdates.phimsexhaymoa.com:2083
fakeupdates.phimsexhaymoa.com:2087
fakeupdates.phimsexhaymoa.com:2096
fakeupdates.phimsexhaymoa.com:8443
socgholish.phimsexhaymoa.com:80
socgholish.phimsexhaymoa.com:22
socgholish.phimsexhaymoa.com:8080
socgholish.phimsexhaymoa.com:8880
socgholish.phimsexhaymoa.com:2052
socgholish.phimsexhaymoa.com:2082
socgholish.phimsexhaymoa.com:2086
socgholish.phimsexhaymoa.com:2095
socgholish.phimsexhaymoa.com:443
socgholish.phimsexhaymoa.com:2053
socgholish.phimsexhaymoa.com:2083
socgholish.phimsexhaymoa.com:2087
socgholish.phimsexhaymoa.com:2096
socgholish.phimsexhaymoa.com:8443
ryuk.phimsexhaymoa.com:80
ryuk.phimsexhaymoa.com:22
ryuk.phimsexhaymoa.com:8080
ryuk.phimsexhaymoa.com:8880
ryuk.phimsexhaymoa.com:2052
ryuk.phimsexhaymoa.com:2082
ryuk.phimsexhaymoa.com:2086
ryuk.phimsexhaymoa.com:2095
ryuk.phimsexhaymoa.com:443
ryuk.phimsexhaymoa.com:2053
ryuk.phimsexhaymoa.com:2083
ryuk.phimsexhaymoa.com:2087
ryuk.phimsexhaymoa.com:2096
ryuk.phimsexhaymoa.com:8443
industroyer.phimsexhaymoa.com:80
industroyer.phimsexhaymoa.com:22
industroyer.phimsexhaymoa.com:8080
industroyer.phimsexhaymoa.com:8880
industroyer.phimsexhaymoa.com:2052
industroyer.phimsexhaymoa.com:2082
industroyer.phimsexhaymoa.com:2086
industroyer.phimsexhaymoa.com:2095
industroyer.phimsexhaymoa.com:443
industroyer.phimsexhaymoa.com:2053
industroyer.phimsexhaymoa.com:2083
industroyer.phimsexhaymoa.com:2087
industroyer.phimsexhaymoa.com:2096
industroyer.phimsexhaymoa.com:8443

Mutex

hplmGoRPpktu

Attributes

delay
0
install
true
install_file
2jt7bjlf.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
956a777bb0a6355467d23c625f595a287c38833d70442d650f072e33e15f8719

File Explorer

956a777bb0a6355467d23c625f595a287c38833d70442d650f072e33e15f8719

.exe 45KB

956a777bb0a6355467d23c625f595a287c38833d70442d650f072e33e15f8719

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 956a777bb0a6355467d23c625f595a287c38833d70442d650f072e33e15f8719
MD5 a91bc10d06d08a7cd7d55ca92a99045e
SHA1 3f66ccf5622ce9d56adeb9c89bc542744f09ffb5
SHA512 dca25680d5b6ef9eb601ec5e71bf9ca33290ea467124bd9351138131b2c609e25e67d7ba7ced3de92638ff70ca7802dd0be3bbf3ff3230a4f06d5135d211b9b3
SSDEEP 768:7uCIJTQc5fVWUhxlDmo2qrn+GtCVnJtHuPI+zjb4gX3iORfYlvk6qTKBDZkx:7uCIJTQmX2q+TB3+3bvXSOpYlvk6qwdm
TLSH
T17E232A0037E8862BF2BE4FB899F26145867AF2633603D54D2CC451D75623FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

956a777bb0a6355467d23c625f595a287c38833d70442d650f072e33e15f8719

mscoree

dotnet