asyncrat | e4c42860bf6b5df41cce9554459b26967086788412562e8f014d0024476caaad

Sharing

Copy URL Twitter E-mail

General

Target
e4c42860bf6b5df41cce9554459b26967086788412562e8f014d0024476caaad
Size 45KB
Sample260905-pcjdastgmd
SHA256 e4c42860bf6b5df41cce9554459b26967086788412562e8f014d0024476caaad
MD5 e95dd7603a213fbca33555dd728d5e66
SHA1 3325bce210621b8839f7f87a463cddc389a49c79
SHA512 3cc3729b1edd0be0227068b013e37b93cf1c6d03d00ffac0e0aa092cc208bea0806e1c7c787b4b69b03120e5f3fb5ae882120407b35d30051723a3c595d19e1f
SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1V8V1RpPEcPIMzjbbgX3i+r4TS6Nk7lfoUTdcuHWB8:wuZ8pT1tc2W8VDZEhM3bkXS+oSWG9o29
TLSH
T1DD232A0037E8C22BF2BE5F789CF26145867AF2672603E6491CC441DB5623BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimdamvl.net:80
phimdamvl.net:22
phimdamvl.net:8080
phimdamvl.net:8880
phimdamvl.net:2052
phimdamvl.net:2082
phimdamvl.net:2086
phimdamvl.net:2095
phimdamvl.net:443
phimdamvl.net:2053
phimdamvl.net:2083
phimdamvl.net:2087
phimdamvl.net:2096
phimdamvl.net:8443
www.phimdamvl.net:80
www.phimdamvl.net:22
www.phimdamvl.net:8080
www.phimdamvl.net:8880
www.phimdamvl.net:2052
www.phimdamvl.net:2082
www.phimdamvl.net:2086
www.phimdamvl.net:2095
www.phimdamvl.net:443
www.phimdamvl.net:2053
www.phimdamvl.net:2083
www.phimdamvl.net:2087
www.phimdamvl.net:2096
www.phimdamvl.net:8443
connect.phimdamvl.net:80
connect.phimdamvl.net:22
connect.phimdamvl.net:8080
connect.phimdamvl.net:8880
connect.phimdamvl.net:2052
connect.phimdamvl.net:2082
connect.phimdamvl.net:2086
connect.phimdamvl.net:2095
connect.phimdamvl.net:443
connect.phimdamvl.net:2053
connect.phimdamvl.net:2083
connect.phimdamvl.net:2087
connect.phimdamvl.net:2096
connect.phimdamvl.net:8443
clop.phimdamvl.net:80
clop.phimdamvl.net:22
clop.phimdamvl.net:8080
clop.phimdamvl.net:8880
clop.phimdamvl.net:2052
clop.phimdamvl.net:2082
clop.phimdamvl.net:2086
clop.phimdamvl.net:2095
clop.phimdamvl.net:443
clop.phimdamvl.net:2053
clop.phimdamvl.net:2083
clop.phimdamvl.net:2087
clop.phimdamvl.net:2096
clop.phimdamvl.net:8443

Mutex

loUE3Snwx9uT

Attributes

delay
0
install
true
install_file
jltu.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e4c42860bf6b5df41cce9554459b26967086788412562e8f014d0024476caaad

File Explorer

e4c42860bf6b5df41cce9554459b26967086788412562e8f014d0024476caaad

.exe 45KB

e4c42860bf6b5df41cce9554459b26967086788412562e8f014d0024476caaad

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e4c42860bf6b5df41cce9554459b26967086788412562e8f014d0024476caaad
MD5 e95dd7603a213fbca33555dd728d5e66
SHA1 3325bce210621b8839f7f87a463cddc389a49c79
SHA512 3cc3729b1edd0be0227068b013e37b93cf1c6d03d00ffac0e0aa092cc208bea0806e1c7c787b4b69b03120e5f3fb5ae882120407b35d30051723a3c595d19e1f
SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1V8V1RpPEcPIMzjbbgX3i+r4TS6Nk7lfoUTdcuHWB8:wuZ8pT1tc2W8VDZEhM3bkXS+oSWG9o29
TLSH
T1DD232A0037E8C22BF2BE5F789CF26145867AF2672603E6491CC441DB5623BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e4c42860bf6b5df41cce9554459b26967086788412562e8f014d0024476caaad

mscoree

dotnet