asyncrat | Client[.]exe

General

Target
Client.exe
Size 46KB
Sample260904-e8645asapc
SHA256 3fd383d14f95fdb789ec1f0f97ce32c618d0f65dcf091b44f00d4fafe9f6dcb3
MD5 54fa1f3d9e12b767513b3281297d84bd
SHA1 580100921a40711c58b7d9f91cecd7f94c1ad0bd
SHA512 41a54cd845ae1e77404fa7993f698053d675569db1b05d0c8bff945dbc42583269dc4070e7689bcdf40dd88d714015ddc446a7d420601d3c15a6820342059bea
SSDEEP 768:fqh/TbXX0u84kOicvHk3eHlWMPbPgF0quyJyfuUEIb1kYI6OC82tYcFmVc6K:fm84XvZH0ub4FruyIfpEIx06OZKmVcl
TLSH
T131231A003BD98136E2BE5FB89DF1514187BAE6233603C65D3CC841DA5B13BCACA51AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat null asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

C2

789win91.cyou:8080
789win91.cyou:443
789win91.cyou:80
789win91.cyou:8443
turbogram.co:8080
turbogram.co:443
turbogram.co:80
turbogram.co:8443
refuel-casino.co:8080
refuel-casino.co:443
refuel-casino.co:80
refuel-casino.co:8443
vavada-tq.buzz:8080
vavada-tq.buzz:443
vavada-tq.buzz:80
vavada-tq.buzz:8443
v52casino.co:8080
v52casino.co:443
v52casino.co:80
v52casino.co:8443
bedefiant.gg:8080
bedefiant.gg:443
bedefiant.gg:80
bedefiant.gg:8443
qh88hcm.com:8080
qh88hcm.com:443
qh88hcm.com:80
qh88hcm.com:8443
xoilacchamtv.ú:8080
xoilacchamtv.ú:443
xoilacchamtv.ú:80
xoilacchamtv.ú:8443
8xbets.cáino:8080
8xbets.cáino:443
8xbets.cáino:80
8xbets.cáino:8443
xoilacchamtv.us:8080
xoilacchamtv.us:443
xoilacchamtv.us:80
xoilacchamtv.us:8443

Mutex

CloudFlare, Inc. (Cloudflare, Inc.)

Attributes

delay
5
install
true
install_file
system.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Client.exe

File Explorer

Client.exe

.exe 46KB

Client.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3fd383d14f95fdb789ec1f0f97ce32c618d0f65dcf091b44f00d4fafe9f6dcb3
MD5 54fa1f3d9e12b767513b3281297d84bd
SHA1 580100921a40711c58b7d9f91cecd7f94c1ad0bd
SHA512 41a54cd845ae1e77404fa7993f698053d675569db1b05d0c8bff945dbc42583269dc4070e7689bcdf40dd88d714015ddc446a7d420601d3c15a6820342059bea
SSDEEP 768:fqh/TbXX0u84kOicvHk3eHlWMPbPgF0quyJyfuUEIb1kYI6OC82tYcFmVc6K:fm84XvZH0ub4FruyIfpEIx06OZKmVcl
TLSH
T131231A003BD98136E2BE5FB89DF1514187BAE6233603C65D3CC841DA5B13BCACA51AF6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

50510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Client.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Client.exe

mscoree

dotnet