asyncrat | 9c72bf7c0eaf7ac62d27fefdd2bd5b2af2a3926565afd6f03f81ed78619e0219

Sharing

Copy URL Twitter E-mail

General

Target
9c72bf7c0eaf7ac62d27fefdd2bd5b2af2a3926565afd6f03f81ed78619e0219
Size 45KB
Sample260905-jb2wcsgn2t
SHA256 9c72bf7c0eaf7ac62d27fefdd2bd5b2af2a3926565afd6f03f81ed78619e0219
MD5 a7553814cd058464328d7e83f26a1520
SHA1 eb1c0db36eec43288d853d922f3386d08f18a8fa
SHA512 c5f95c3f39dcbca652c1db9df4b01fbab10ff2e0c6d762613efb11d13f4860a1a660dfcd16a6aae1c11586638f4f5a2cf0122a8d1a92aaf7b84dfadb9f13906a
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9MCOtTMtPINzjbjgX3iqvRz+0VDjJbBDZ8x:0u1YJTHcw2TRvN3b8XSqpqOtNd8x
TLSH
T190232B003BE8822BF2BE4F78A9F26145867AF6673603D54D2CC451DB5613FC686426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sextop1.page:80
sextop1.page:22
sextop1.page:8080
sextop1.page:8880
sextop1.page:2052
sextop1.page:2082
sextop1.page:2086
sextop1.page:2095
sextop1.page:443
sextop1.page:2053
sextop1.page:2083
sextop1.page:2087
sextop1.page:2096
sextop1.page:8443
www.sextop1.page:80
www.sextop1.page:22
www.sextop1.page:8080
www.sextop1.page:8880
www.sextop1.page:2052
www.sextop1.page:2082
www.sextop1.page:2086
www.sextop1.page:2095
www.sextop1.page:443
www.sextop1.page:2053
www.sextop1.page:2083
www.sextop1.page:2087
www.sextop1.page:2096
www.sextop1.page:8443
lokibot.sextop1.page:80
lokibot.sextop1.page:22
lokibot.sextop1.page:8080
lokibot.sextop1.page:8880
lokibot.sextop1.page:2052
lokibot.sextop1.page:2082
lokibot.sextop1.page:2086
lokibot.sextop1.page:2095
lokibot.sextop1.page:443
lokibot.sextop1.page:2053
lokibot.sextop1.page:2083
lokibot.sextop1.page:2087
lokibot.sextop1.page:2096
lokibot.sextop1.page:8443
ryuk.sextop1.page:80
ryuk.sextop1.page:22
ryuk.sextop1.page:8080
ryuk.sextop1.page:8880
ryuk.sextop1.page:2052
ryuk.sextop1.page:2082
ryuk.sextop1.page:2086
ryuk.sextop1.page:2095
ryuk.sextop1.page:443
ryuk.sextop1.page:2053
ryuk.sextop1.page:2083
ryuk.sextop1.page:2087
ryuk.sextop1.page:2096
ryuk.sextop1.page:8443
nanocore.sextop1.page:80
nanocore.sextop1.page:22
nanocore.sextop1.page:8080
nanocore.sextop1.page:8880
nanocore.sextop1.page:2052
nanocore.sextop1.page:2082
nanocore.sextop1.page:2086
nanocore.sextop1.page:2095
nanocore.sextop1.page:443
nanocore.sextop1.page:2053
nanocore.sextop1.page:2083
nanocore.sextop1.page:2087
nanocore.sextop1.page:2096
nanocore.sextop1.page:8443

Mutex

Is7fbcDtBAfw

Attributes

delay
0
install
true
install_file
00k8b4.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c72bf7c0eaf7ac62d27fefdd2bd5b2af2a3926565afd6f03f81ed78619e0219

File Explorer

9c72bf7c0eaf7ac62d27fefdd2bd5b2af2a3926565afd6f03f81ed78619e0219

.exe 45KB

9c72bf7c0eaf7ac62d27fefdd2bd5b2af2a3926565afd6f03f81ed78619e0219

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9c72bf7c0eaf7ac62d27fefdd2bd5b2af2a3926565afd6f03f81ed78619e0219
MD5 a7553814cd058464328d7e83f26a1520
SHA1 eb1c0db36eec43288d853d922f3386d08f18a8fa
SHA512 c5f95c3f39dcbca652c1db9df4b01fbab10ff2e0c6d762613efb11d13f4860a1a660dfcd16a6aae1c11586638f4f5a2cf0122a8d1a92aaf7b84dfadb9f13906a
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9MCOtTMtPINzjbjgX3iqvRz+0VDjJbBDZ8x:0u1YJTHcw2TRvN3b8XSqpqOtNd8x
TLSH
T190232B003BE8822BF2BE4F78A9F26145867AF6673603D54D2CC451DB5613FC686426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

9c72bf7c0eaf7ac62d27fefdd2bd5b2af2a3926565afd6f03f81ed78619e0219

mscoree

dotnet