asyncrat | f5a8977f378e02c6dd8db3290fe88d6aee31139ab33319e35013c247facb5618

Sharing

Copy URL Twitter E-mail

General

Target
f5a8977f378e02c6dd8db3290fe88d6aee31139ab33319e35013c247facb5618
Size 45KB
Sample260905-k4tk5a1dnc
SHA256 f5a8977f378e02c6dd8db3290fe88d6aee31139ab33319e35013c247facb5618
MD5 32ca318689eb6edba2291fdd0bfe202f
SHA1 f706730770347da99f0a9fb6caece6892baca53a
SHA512 f3eb22380958e1b85a1c37c06d1af596c13df38fe099e58edcf84870e4c5b5cf4732c6f6673df454d6175c11d9e630b71c55fe5037c2d8262158c74e8a87a7cb
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8lsHoPEaMPIPpjbugX3iNYBCMa/m5FNgBDZMx:ku40ZTXEb24uuEaxPJbRXSNYBa/02dMx
TLSH
T1FE232B103BE8C22BF2BE4F7899F26145467EF6636603D5491CC442DB4613FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xemheo.info:80
xemheo.info:22
xemheo.info:8080
xemheo.info:8880
xemheo.info:2052
xemheo.info:2082
xemheo.info:2086
xemheo.info:2095
xemheo.info:443
xemheo.info:2053
xemheo.info:2083
xemheo.info:2087
xemheo.info:2096
xemheo.info:8443
www.xemheo.info:80
www.xemheo.info:22
www.xemheo.info:8080
www.xemheo.info:8880
www.xemheo.info:2052
www.xemheo.info:2082
www.xemheo.info:2086
www.xemheo.info:2095
www.xemheo.info:443
www.xemheo.info:2053
www.xemheo.info:2083
www.xemheo.info:2087
www.xemheo.info:2096
www.xemheo.info:8443
sasser.xemheo.info:80
sasser.xemheo.info:22
sasser.xemheo.info:8080
sasser.xemheo.info:8880
sasser.xemheo.info:2052
sasser.xemheo.info:2082
sasser.xemheo.info:2086
sasser.xemheo.info:2095
sasser.xemheo.info:443
sasser.xemheo.info:2053
sasser.xemheo.info:2083
sasser.xemheo.info:2087
sasser.xemheo.info:2096
sasser.xemheo.info:8443
invasive.xemheo.info:80
invasive.xemheo.info:22
invasive.xemheo.info:8080
invasive.xemheo.info:8880
invasive.xemheo.info:2052
invasive.xemheo.info:2082
invasive.xemheo.info:2086
invasive.xemheo.info:2095
invasive.xemheo.info:443
invasive.xemheo.info:2053
invasive.xemheo.info:2083
invasive.xemheo.info:2087
invasive.xemheo.info:2096
invasive.xemheo.info:8443
hermeticwiper.xemheo.info:80
hermeticwiper.xemheo.info:22
hermeticwiper.xemheo.info:8080
hermeticwiper.xemheo.info:8880
hermeticwiper.xemheo.info:2052
hermeticwiper.xemheo.info:2082
hermeticwiper.xemheo.info:2086
hermeticwiper.xemheo.info:2095
hermeticwiper.xemheo.info:443
hermeticwiper.xemheo.info:2053
hermeticwiper.xemheo.info:2083
hermeticwiper.xemheo.info:2087
hermeticwiper.xemheo.info:2096
hermeticwiper.xemheo.info:8443
notpetya.xemheo.info:80
notpetya.xemheo.info:22
notpetya.xemheo.info:8080
notpetya.xemheo.info:8880
notpetya.xemheo.info:2052
notpetya.xemheo.info:2082
notpetya.xemheo.info:2086
notpetya.xemheo.info:2095
notpetya.xemheo.info:443
notpetya.xemheo.info:2053
notpetya.xemheo.info:2083
notpetya.xemheo.info:2087
notpetya.xemheo.info:2096
notpetya.xemheo.info:8443

Mutex

rI7uHuscbDez

Attributes

delay
0
install
true
install_file
rqtlc.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5a8977f378e02c6dd8db3290fe88d6aee31139ab33319e35013c247facb5618

File Explorer

f5a8977f378e02c6dd8db3290fe88d6aee31139ab33319e35013c247facb5618

.exe 45KB

f5a8977f378e02c6dd8db3290fe88d6aee31139ab33319e35013c247facb5618

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f5a8977f378e02c6dd8db3290fe88d6aee31139ab33319e35013c247facb5618
MD5 32ca318689eb6edba2291fdd0bfe202f
SHA1 f706730770347da99f0a9fb6caece6892baca53a
SHA512 f3eb22380958e1b85a1c37c06d1af596c13df38fe099e58edcf84870e4c5b5cf4732c6f6673df454d6175c11d9e630b71c55fe5037c2d8262158c74e8a87a7cb
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8lsHoPEaMPIPpjbugX3iNYBCMa/m5FNgBDZMx:ku40ZTXEb24uuEaxPJbRXSNYBa/02dMx
TLSH
T1FE232B103BE8C22BF2BE4F7899F26145467EF6636603D5491CC442DB4613FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f5a8977f378e02c6dd8db3290fe88d6aee31139ab33319e35013c247facb5618

mscoree

dotnet