asyncrat | deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e

Sharing

Copy URL Twitter E-mail

General

Target
deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e
Size 45KB
Sample260905-jpbakacf66
SHA256 deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e
MD5 81193702e378bf8ca9ab5ce42b4a5e36
SHA1 29bc6c1cce786597e3e84f025c9f0833690ce53f
SHA512 c798b01af02e2f9473b0c1e5c8e8da6fc76893590a4ff8afe06f9fe1200616f415c3a97b7023d7d9eb482ffe72beb87e9dadfda70e6c37fae4c67e316919eccb
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPIQWjbhgX3iM2qdQZqkW9GYIkCBDZsx:EulCJTHl42sU3QabOXSM2wqqkYnqdsx
TLSH
T19C232B0037E8C127F2BE4B7859F26245867AF2673603D69E1CC4419B5723FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

gainungvn.top:80
gainungvn.top:22
gainungvn.top:8080
gainungvn.top:8880
gainungvn.top:2052
gainungvn.top:2082
gainungvn.top:2086
gainungvn.top:2095
gainungvn.top:443
gainungvn.top:2053
gainungvn.top:2083
gainungvn.top:2087
gainungvn.top:2096
gainungvn.top:8443
www.gainungvn.top:80
www.gainungvn.top:22
www.gainungvn.top:8080
www.gainungvn.top:8880
www.gainungvn.top:2052
www.gainungvn.top:2082
www.gainungvn.top:2086
www.gainungvn.top:2095
www.gainungvn.top:443
www.gainungvn.top:2053
www.gainungvn.top:2083
www.gainungvn.top:2087
www.gainungvn.top:2096
www.gainungvn.top:8443
blaster.gainungvn.top:80
blaster.gainungvn.top:22
blaster.gainungvn.top:8080
blaster.gainungvn.top:8880
blaster.gainungvn.top:2052
blaster.gainungvn.top:2082
blaster.gainungvn.top:2086
blaster.gainungvn.top:2095
blaster.gainungvn.top:443
blaster.gainungvn.top:2053
blaster.gainungvn.top:2083
blaster.gainungvn.top:2087
blaster.gainungvn.top:2096
blaster.gainungvn.top:8443
qbot.gainungvn.top:80
qbot.gainungvn.top:22
qbot.gainungvn.top:8080
qbot.gainungvn.top:8880
qbot.gainungvn.top:2052
qbot.gainungvn.top:2082
qbot.gainungvn.top:2086
qbot.gainungvn.top:2095
qbot.gainungvn.top:443
qbot.gainungvn.top:2053
qbot.gainungvn.top:2083
qbot.gainungvn.top:2087
qbot.gainungvn.top:2096
qbot.gainungvn.top:8443
ryuk.gainungvn.top:80
ryuk.gainungvn.top:22
ryuk.gainungvn.top:8080
ryuk.gainungvn.top:8880
ryuk.gainungvn.top:2052
ryuk.gainungvn.top:2082
ryuk.gainungvn.top:2086
ryuk.gainungvn.top:2095
ryuk.gainungvn.top:443
ryuk.gainungvn.top:2053
ryuk.gainungvn.top:2083
ryuk.gainungvn.top:2087
ryuk.gainungvn.top:2096
ryuk.gainungvn.top:8443
clop.gainungvn.top:80
clop.gainungvn.top:22
clop.gainungvn.top:8080
clop.gainungvn.top:8880
clop.gainungvn.top:2052
clop.gainungvn.top:2082
clop.gainungvn.top:2086
clop.gainungvn.top:2095
clop.gainungvn.top:443
clop.gainungvn.top:2053
clop.gainungvn.top:2083
clop.gainungvn.top:2087
clop.gainungvn.top:2096
clop.gainungvn.top:8443

Mutex

33dr4YCrVehG

Attributes

delay
0
install
true
install_file
m8eh9b.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e

File Explorer

deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e

.exe 45KB

deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e
MD5 81193702e378bf8ca9ab5ce42b4a5e36
SHA1 29bc6c1cce786597e3e84f025c9f0833690ce53f
SHA512 c798b01af02e2f9473b0c1e5c8e8da6fc76893590a4ff8afe06f9fe1200616f415c3a97b7023d7d9eb482ffe72beb87e9dadfda70e6c37fae4c67e316919eccb
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPIQWjbhgX3iM2qdQZqkW9GYIkCBDZsx:EulCJTHl42sU3QabOXSM2wqqkYnqdsx
TLSH
T19C232B0037E8C127F2BE4B7859F26245867AF2673603D69E1CC4419B5723FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

deb16afaf86e7e4a2e39b1161041beae27e8e30e7700bcf04f6fac1e1421130e

mscoree

dotnet