asyncrat | 62b5344607bb320a1b1fb1e308a108e666d5df25b09746dcce1ab92ecfe79772

Sharing

Copy URL Twitter E-mail

General

Target
62b5344607bb320a1b1fb1e308a108e666d5df25b09746dcce1ab92ecfe79772
Size 45KB
Sample260905-r2fd2stvct
SHA256 62b5344607bb320a1b1fb1e308a108e666d5df25b09746dcce1ab92ecfe79772
MD5 6ec32cacd17d826b5ba846f9ecac3de6
SHA1 dd8e51ff1f52c5dbb167d7d98137d39b37a696fe
SHA512 59db1ca799d310793739b45f650c17856d2a2ab2842ee40fb458854371297ab13856d415cc2d35de8f9ad698f1c065f45c180be40a16ecc2ea028288efcb8e05
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9FORw4iS36NjPIgzjbVgX35JB4GgrVwpE7YG3+BDZ8x:0uPrpT/qY2UORDf6Kg3byXpAGeMyAd8x
TLSH
T1FA232A003BE8812BF2BE5F7899F26145867AF6633603E9492CC451DB5713FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hentaiz.buzz:80
hentaiz.buzz:22
hentaiz.buzz:8080
hentaiz.buzz:8880
hentaiz.buzz:2052
hentaiz.buzz:2082
hentaiz.buzz:2086
hentaiz.buzz:2095
hentaiz.buzz:443
hentaiz.buzz:2053
hentaiz.buzz:2083
hentaiz.buzz:2087
hentaiz.buzz:2096
hentaiz.buzz:8443
www.hentaiz.buzz:80
www.hentaiz.buzz:22
www.hentaiz.buzz:8080
www.hentaiz.buzz:8880
www.hentaiz.buzz:2052
www.hentaiz.buzz:2082
www.hentaiz.buzz:2086
www.hentaiz.buzz:2095
www.hentaiz.buzz:443
www.hentaiz.buzz:2053
www.hentaiz.buzz:2083
www.hentaiz.buzz:2087
www.hentaiz.buzz:2096
www.hentaiz.buzz:8443
clop.hentaiz.buzz:80
clop.hentaiz.buzz:22
clop.hentaiz.buzz:8080
clop.hentaiz.buzz:8880
clop.hentaiz.buzz:2052
clop.hentaiz.buzz:2082
clop.hentaiz.buzz:2086
clop.hentaiz.buzz:2095
clop.hentaiz.buzz:443
clop.hentaiz.buzz:2053
clop.hentaiz.buzz:2083
clop.hentaiz.buzz:2087
clop.hentaiz.buzz:2096
clop.hentaiz.buzz:8443
emotet.hentaiz.buzz:80
emotet.hentaiz.buzz:22
emotet.hentaiz.buzz:8080
emotet.hentaiz.buzz:8880
emotet.hentaiz.buzz:2052
emotet.hentaiz.buzz:2082
emotet.hentaiz.buzz:2086
emotet.hentaiz.buzz:2095
emotet.hentaiz.buzz:443
emotet.hentaiz.buzz:2053
emotet.hentaiz.buzz:2083
emotet.hentaiz.buzz:2087
emotet.hentaiz.buzz:2096
emotet.hentaiz.buzz:8443
sasser.hentaiz.buzz:80
sasser.hentaiz.buzz:22
sasser.hentaiz.buzz:8080
sasser.hentaiz.buzz:8880
sasser.hentaiz.buzz:2052
sasser.hentaiz.buzz:2082
sasser.hentaiz.buzz:2086
sasser.hentaiz.buzz:2095
sasser.hentaiz.buzz:443
sasser.hentaiz.buzz:2053
sasser.hentaiz.buzz:2083
sasser.hentaiz.buzz:2087
sasser.hentaiz.buzz:2096
sasser.hentaiz.buzz:8443

Mutex

3g57mVkqwDNc

Attributes

delay
0
install
true
install_file
kjsuo1t.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
62b5344607bb320a1b1fb1e308a108e666d5df25b09746dcce1ab92ecfe79772

File Explorer

62b5344607bb320a1b1fb1e308a108e666d5df25b09746dcce1ab92ecfe79772

.exe 45KB

62b5344607bb320a1b1fb1e308a108e666d5df25b09746dcce1ab92ecfe79772

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 62b5344607bb320a1b1fb1e308a108e666d5df25b09746dcce1ab92ecfe79772
MD5 6ec32cacd17d826b5ba846f9ecac3de6
SHA1 dd8e51ff1f52c5dbb167d7d98137d39b37a696fe
SHA512 59db1ca799d310793739b45f650c17856d2a2ab2842ee40fb458854371297ab13856d415cc2d35de8f9ad698f1c065f45c180be40a16ecc2ea028288efcb8e05
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9FORw4iS36NjPIgzjbVgX35JB4GgrVwpE7YG3+BDZ8x:0uPrpT/qY2UORDf6Kg3byXpAGeMyAd8x
TLSH
T1FA232A003BE8812BF2BE5F7899F26145867AF6633603E9492CC451DB5713FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

62b5344607bb320a1b1fb1e308a108e666d5df25b09746dcce1ab92ecfe79772

mscoree

dotnet