asyncrat | 03598ea333d3683e9efbf3e33afd6b97907f833e1ab6c5d3f43a3673735bcd57

Sharing

Copy URL Twitter E-mail

General

Target
03598ea333d3683e9efbf3e33afd6b97907f833e1ab6c5d3f43a3673735bcd57
Size 45KB
Sample260905-mv1dessfqa
SHA256 03598ea333d3683e9efbf3e33afd6b97907f833e1ab6c5d3f43a3673735bcd57
MD5 cdb8730bdc73f060bc8a73bd32672d6b
SHA1 df7836168b096d80859b164ef9ab25ac7c7a7fb8
SHA512 cbe5d81135ffa68115c95355153ee9f5fa49597f05646d2eefb3c970dd4a2e8e5339a96689f64f98922b479dc284cf5e65bad7a67d2b1c9aca27f7b41ff64e2b
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY6iaLzwJAOPIcFzjbngXOiZJzmh60ERI43qBDZ0x:8uuSpTgyf2i5U23cF3bgX3rzmh60gIyP
TLSH
T117231B003BE9812BF2BE4B7898F26145867EF6633603D58E1CC451DB5613FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hentaiz.buzz:80
hentaiz.buzz:22
hentaiz.buzz:8080
hentaiz.buzz:8880
hentaiz.buzz:2052
hentaiz.buzz:2082
hentaiz.buzz:2086
hentaiz.buzz:2095
hentaiz.buzz:443
hentaiz.buzz:2053
hentaiz.buzz:2083
hentaiz.buzz:2087
hentaiz.buzz:2096
hentaiz.buzz:8443
www.hentaiz.buzz:80
www.hentaiz.buzz:22
www.hentaiz.buzz:8080
www.hentaiz.buzz:8880
www.hentaiz.buzz:2052
www.hentaiz.buzz:2082
www.hentaiz.buzz:2086
www.hentaiz.buzz:2095
www.hentaiz.buzz:443
www.hentaiz.buzz:2053
www.hentaiz.buzz:2083
www.hentaiz.buzz:2087
www.hentaiz.buzz:2096
www.hentaiz.buzz:8443
industroyer.hentaiz.buzz:80
industroyer.hentaiz.buzz:22
industroyer.hentaiz.buzz:8080
industroyer.hentaiz.buzz:8880
industroyer.hentaiz.buzz:2052
industroyer.hentaiz.buzz:2082
industroyer.hentaiz.buzz:2086
industroyer.hentaiz.buzz:2095
industroyer.hentaiz.buzz:443
industroyer.hentaiz.buzz:2053
industroyer.hentaiz.buzz:2083
industroyer.hentaiz.buzz:2087
industroyer.hentaiz.buzz:2096
industroyer.hentaiz.buzz:8443
clop.hentaiz.buzz:80
clop.hentaiz.buzz:22
clop.hentaiz.buzz:8080
clop.hentaiz.buzz:8880
clop.hentaiz.buzz:2052
clop.hentaiz.buzz:2082
clop.hentaiz.buzz:2086
clop.hentaiz.buzz:2095
clop.hentaiz.buzz:443
clop.hentaiz.buzz:2053
clop.hentaiz.buzz:2083
clop.hentaiz.buzz:2087
clop.hentaiz.buzz:2096
clop.hentaiz.buzz:8443
notpetya.hentaiz.buzz:80
notpetya.hentaiz.buzz:22
notpetya.hentaiz.buzz:8080
notpetya.hentaiz.buzz:8880
notpetya.hentaiz.buzz:2052
notpetya.hentaiz.buzz:2082
notpetya.hentaiz.buzz:2086
notpetya.hentaiz.buzz:2095
notpetya.hentaiz.buzz:443
notpetya.hentaiz.buzz:2053
notpetya.hentaiz.buzz:2083
notpetya.hentaiz.buzz:2087
notpetya.hentaiz.buzz:2096
notpetya.hentaiz.buzz:8443
sodinokibi.hentaiz.buzz:80
sodinokibi.hentaiz.buzz:22
sodinokibi.hentaiz.buzz:8080
sodinokibi.hentaiz.buzz:8880
sodinokibi.hentaiz.buzz:2052
sodinokibi.hentaiz.buzz:2082
sodinokibi.hentaiz.buzz:2086
sodinokibi.hentaiz.buzz:2095
sodinokibi.hentaiz.buzz:443
sodinokibi.hentaiz.buzz:2053
sodinokibi.hentaiz.buzz:2083
sodinokibi.hentaiz.buzz:2087
sodinokibi.hentaiz.buzz:2096
sodinokibi.hentaiz.buzz:8443

Mutex

4t0skb2aqGGX

Attributes

delay
0
install
true
install_file
ja5h4o.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03598ea333d3683e9efbf3e33afd6b97907f833e1ab6c5d3f43a3673735bcd57

File Explorer

03598ea333d3683e9efbf3e33afd6b97907f833e1ab6c5d3f43a3673735bcd57

.exe 45KB

03598ea333d3683e9efbf3e33afd6b97907f833e1ab6c5d3f43a3673735bcd57

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 03598ea333d3683e9efbf3e33afd6b97907f833e1ab6c5d3f43a3673735bcd57
MD5 cdb8730bdc73f060bc8a73bd32672d6b
SHA1 df7836168b096d80859b164ef9ab25ac7c7a7fb8
SHA512 cbe5d81135ffa68115c95355153ee9f5fa49597f05646d2eefb3c970dd4a2e8e5339a96689f64f98922b479dc284cf5e65bad7a67d2b1c9aca27f7b41ff64e2b
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY6iaLzwJAOPIcFzjbngXOiZJzmh60ERI43qBDZ0x:8uuSpTgyf2i5U23cF3bgX3rzmh60gIyP
TLSH
T117231B003BE9812BF2BE4B7898F26145867EF6633603D58E1CC451DB5613FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

03598ea333d3683e9efbf3e33afd6b97907f833e1ab6c5d3f43a3673735bcd57

mscoree

dotnet