asyncrat | 87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc

Sharing

Copy URL Twitter E-mail

General

Target
87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc
Size 45KB
Sample260905-ns69matdnb
SHA256 87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc
MD5 7f208d3e8de6f14d22fd8f163e78bf04
SHA1 4b6e581bfcbadc11805204fc87372e3ac465fc94
SHA512 d122838825a8980a85736450fe73b2280c2a02aabe07f14bf255e1a845d6a5af77a52e6b4f1b5a932cda81a209d6d96540d6d5f75d028f2701923a2d5b454bd2
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/NYssPJZOPIczzjbVgXkiFv1L8V8QQ0Qag9BDZsx:EulCJTHl42eHIf3cz3byXhLL8JQ0bgTc
TLSH
T14B231B0037E8822BF2BE4F749CF26145867AF6673603E58A1CC451DB5613FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

gainungvn.top:80
gainungvn.top:22
gainungvn.top:8080
gainungvn.top:8880
gainungvn.top:2052
gainungvn.top:2082
gainungvn.top:2086
gainungvn.top:2095
gainungvn.top:443
gainungvn.top:2053
gainungvn.top:2083
gainungvn.top:2087
gainungvn.top:2096
gainungvn.top:8443
www.gainungvn.top:80
www.gainungvn.top:22
www.gainungvn.top:8080
www.gainungvn.top:8880
www.gainungvn.top:2052
www.gainungvn.top:2082
www.gainungvn.top:2086
www.gainungvn.top:2095
www.gainungvn.top:443
www.gainungvn.top:2053
www.gainungvn.top:2083
www.gainungvn.top:2087
www.gainungvn.top:2096
www.gainungvn.top:8443
remcos.gainungvn.top:80
remcos.gainungvn.top:22
remcos.gainungvn.top:8080
remcos.gainungvn.top:8880
remcos.gainungvn.top:2052
remcos.gainungvn.top:2082
remcos.gainungvn.top:2086
remcos.gainungvn.top:2095
remcos.gainungvn.top:443
remcos.gainungvn.top:2053
remcos.gainungvn.top:2083
remcos.gainungvn.top:2087
remcos.gainungvn.top:2096
remcos.gainungvn.top:8443
codered.gainungvn.top:80
codered.gainungvn.top:22
codered.gainungvn.top:8080
codered.gainungvn.top:8880
codered.gainungvn.top:2052
codered.gainungvn.top:2082
codered.gainungvn.top:2086
codered.gainungvn.top:2095
codered.gainungvn.top:443
codered.gainungvn.top:2053
codered.gainungvn.top:2083
codered.gainungvn.top:2087
codered.gainungvn.top:2096
codered.gainungvn.top:8443
trickbot.gainungvn.top:80
trickbot.gainungvn.top:22
trickbot.gainungvn.top:8080
trickbot.gainungvn.top:8880
trickbot.gainungvn.top:2052
trickbot.gainungvn.top:2082
trickbot.gainungvn.top:2086
trickbot.gainungvn.top:2095
trickbot.gainungvn.top:443
trickbot.gainungvn.top:2053
trickbot.gainungvn.top:2083
trickbot.gainungvn.top:2087
trickbot.gainungvn.top:2096
trickbot.gainungvn.top:8443

Mutex

3rBCXdDF9WDF

Attributes

delay
0
install
true
install_file
x099bq.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc

File Explorer

87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc

.exe 45KB

87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc
MD5 7f208d3e8de6f14d22fd8f163e78bf04
SHA1 4b6e581bfcbadc11805204fc87372e3ac465fc94
SHA512 d122838825a8980a85736450fe73b2280c2a02aabe07f14bf255e1a845d6a5af77a52e6b4f1b5a932cda81a209d6d96540d6d5f75d028f2701923a2d5b454bd2
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/NYssPJZOPIczzjbVgXkiFv1L8V8QQ0Qag9BDZsx:EulCJTHl42eHIf3cz3byXhLL8JQ0bgTc
TLSH
T14B231B0037E8822BF2BE4F749CF26145867AF6673603E58A1CC451DB5613FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

87e879e47fe139c39fec1243eb8d7d4461887c2e6618250aa55ed37405dac5fc

mscoree

dotnet