asyncrat | 8e811858205069e964412617f659e91466a76504e8ed47caf7ab5c8b3c6a6704

Sharing

Copy URL Twitter E-mail

General

Target
8e811858205069e964412617f659e91466a76504e8ed47caf7ab5c8b3c6a6704
Size 45KB
Sample260905-msdrmszsc1
SHA256 8e811858205069e964412617f659e91466a76504e8ed47caf7ab5c8b3c6a6704
MD5 bb94edb296eb306986ce66488ab03916
SHA1 2c7b4000cc75f370f9dba4a11b6286900e4a68e5
SHA512 4d773426f9fe4934f77884f456a053ef83fc58da3f933037f9b9bf8b7d7f7ea96b458b50907550952f681a48367fe0185c164af8ff8ce27b92d16cb3b61b67ca
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1s3wZQaKkPIHzjbegX3ionTS2gBDZUx:cu6YepTPso2QIH3bhXS6idUx
TLSH
T1BE231A003BE9813BF2BE5FB86DF26145867AF6632603D9492CC451DB5623FC18A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

xemjav-hd.click:80
xemjav-hd.click:22
xemjav-hd.click:8080
xemjav-hd.click:8880
xemjav-hd.click:2052
xemjav-hd.click:2082
xemjav-hd.click:2086
xemjav-hd.click:2095
xemjav-hd.click:443
xemjav-hd.click:2053
xemjav-hd.click:2083
xemjav-hd.click:2087
xemjav-hd.click:2096
xemjav-hd.click:8443
www.xemjav-hd.click:80
www.xemjav-hd.click:22
www.xemjav-hd.click:8080
www.xemjav-hd.click:8880
www.xemjav-hd.click:2052
www.xemjav-hd.click:2082
www.xemjav-hd.click:2086
www.xemjav-hd.click:2095
www.xemjav-hd.click:443
www.xemjav-hd.click:2053
www.xemjav-hd.click:2083
www.xemjav-hd.click:2087
www.xemjav-hd.click:2096
www.xemjav-hd.click:8443
nimda.xemjav-hd.click:80
nimda.xemjav-hd.click:22
nimda.xemjav-hd.click:8080
nimda.xemjav-hd.click:8880
nimda.xemjav-hd.click:2052
nimda.xemjav-hd.click:2082
nimda.xemjav-hd.click:2086
nimda.xemjav-hd.click:2095
nimda.xemjav-hd.click:443
nimda.xemjav-hd.click:2053
nimda.xemjav-hd.click:2083
nimda.xemjav-hd.click:2087
nimda.xemjav-hd.click:2096
nimda.xemjav-hd.click:8443
socgholish.xemjav-hd.click:80
socgholish.xemjav-hd.click:22
socgholish.xemjav-hd.click:8080
socgholish.xemjav-hd.click:8880
socgholish.xemjav-hd.click:2052
socgholish.xemjav-hd.click:2082
socgholish.xemjav-hd.click:2086
socgholish.xemjav-hd.click:2095
socgholish.xemjav-hd.click:443
socgholish.xemjav-hd.click:2053
socgholish.xemjav-hd.click:2083
socgholish.xemjav-hd.click:2087
socgholish.xemjav-hd.click:2096
socgholish.xemjav-hd.click:8443
triton.xemjav-hd.click:80
triton.xemjav-hd.click:22
triton.xemjav-hd.click:8080
triton.xemjav-hd.click:8880
triton.xemjav-hd.click:2052
triton.xemjav-hd.click:2082
triton.xemjav-hd.click:2086
triton.xemjav-hd.click:2095
triton.xemjav-hd.click:443
triton.xemjav-hd.click:2053
triton.xemjav-hd.click:2083
triton.xemjav-hd.click:2087
triton.xemjav-hd.click:2096
triton.xemjav-hd.click:8443

Mutex

bApNya3WYwkQ

Attributes

delay
0
install
true
install_file
63rxmm90.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e811858205069e964412617f659e91466a76504e8ed47caf7ab5c8b3c6a6704

File Explorer

8e811858205069e964412617f659e91466a76504e8ed47caf7ab5c8b3c6a6704

.exe 45KB

8e811858205069e964412617f659e91466a76504e8ed47caf7ab5c8b3c6a6704

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8e811858205069e964412617f659e91466a76504e8ed47caf7ab5c8b3c6a6704
MD5 bb94edb296eb306986ce66488ab03916
SHA1 2c7b4000cc75f370f9dba4a11b6286900e4a68e5
SHA512 4d773426f9fe4934f77884f456a053ef83fc58da3f933037f9b9bf8b7d7f7ea96b458b50907550952f681a48367fe0185c164af8ff8ce27b92d16cb3b61b67ca
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1s3wZQaKkPIHzjbegX3ionTS2gBDZUx:cu6YepTPso2QIH3bhXS6idUx
TLSH
T1BE231A003BE9813BF2BE5FB86DF26145867AF6632603D9492CC451DB5623FC18A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

8e811858205069e964412617f659e91466a76504e8ed47caf7ab5c8b3c6a6704

mscoree

dotnet