asyncrat | a61627434459b3e58c25963cabc1a9b0213d11a46ec01a640988ceab517e535e

Sharing

Copy URL Twitter E-mail

General

Target
a61627434459b3e58c25963cabc1a9b0213d11a46ec01a640988ceab517e535e
Size 45KB
Sample260905-rayfjsdm9v
SHA256 a61627434459b3e58c25963cabc1a9b0213d11a46ec01a640988ceab517e535e
MD5 15bf4c586b8d07f86488c3180f29dd3e
SHA1 1d5b814fae32ef4b9c16c2776a5b96514ab795c1
SHA512 d5d699830f7de3b91449080e6388ec7f7c993fcc824d3d60778e2104415825601777feaa27e192cc2d57e8a8dca94f1f58445f4d43e5d994db69a06ad8178745
SSDEEP 768:4uBfJTMUyYUWUWBDimo2qVecP0pycvHPIjzjbjgX3i9Xd7vV2FmhAnBDZbx:4uBfJTMpv2NccMcvgj3b8XS9XdLV2U8/
TLSH
T199231B003BE8C237F2BE4F78A8F26145467AF6636603D5491CC451DB5623FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vlxxtv.org:80
vlxxtv.org:22
vlxxtv.org:8080
vlxxtv.org:8880
vlxxtv.org:2052
vlxxtv.org:2082
vlxxtv.org:2086
vlxxtv.org:2095
vlxxtv.org:443
vlxxtv.org:2053
vlxxtv.org:2083
vlxxtv.org:2087
vlxxtv.org:2096
vlxxtv.org:8443
www.vlxxtv.org:80
www.vlxxtv.org:22
www.vlxxtv.org:8080
www.vlxxtv.org:8880
www.vlxxtv.org:2052
www.vlxxtv.org:2082
www.vlxxtv.org:2086
www.vlxxtv.org:2095
www.vlxxtv.org:443
www.vlxxtv.org:2053
www.vlxxtv.org:2083
www.vlxxtv.org:2087
www.vlxxtv.org:2096
www.vlxxtv.org:8443
sasser.vlxxtv.org:80
sasser.vlxxtv.org:22
sasser.vlxxtv.org:8080
sasser.vlxxtv.org:8880
sasser.vlxxtv.org:2052
sasser.vlxxtv.org:2082
sasser.vlxxtv.org:2086
sasser.vlxxtv.org:2095
sasser.vlxxtv.org:443
sasser.vlxxtv.org:2053
sasser.vlxxtv.org:2083
sasser.vlxxtv.org:2087
sasser.vlxxtv.org:2096
sasser.vlxxtv.org:8443
ursnif.vlxxtv.org:80
ursnif.vlxxtv.org:22
ursnif.vlxxtv.org:8080
ursnif.vlxxtv.org:8880
ursnif.vlxxtv.org:2052
ursnif.vlxxtv.org:2082
ursnif.vlxxtv.org:2086
ursnif.vlxxtv.org:2095
ursnif.vlxxtv.org:443
ursnif.vlxxtv.org:2053
ursnif.vlxxtv.org:2083
ursnif.vlxxtv.org:2087
ursnif.vlxxtv.org:2096
ursnif.vlxxtv.org:8443

Mutex

0vu7nGPzNRH7

Attributes

delay
0
install
true
install_file
q42z.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a61627434459b3e58c25963cabc1a9b0213d11a46ec01a640988ceab517e535e

File Explorer

a61627434459b3e58c25963cabc1a9b0213d11a46ec01a640988ceab517e535e

.exe 45KB

a61627434459b3e58c25963cabc1a9b0213d11a46ec01a640988ceab517e535e

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a61627434459b3e58c25963cabc1a9b0213d11a46ec01a640988ceab517e535e
MD5 15bf4c586b8d07f86488c3180f29dd3e
SHA1 1d5b814fae32ef4b9c16c2776a5b96514ab795c1
SHA512 d5d699830f7de3b91449080e6388ec7f7c993fcc824d3d60778e2104415825601777feaa27e192cc2d57e8a8dca94f1f58445f4d43e5d994db69a06ad8178745
SSDEEP 768:4uBfJTMUyYUWUWBDimo2qVecP0pycvHPIjzjbjgX3i9Xd7vV2FmhAnBDZbx:4uBfJTMpv2NccMcvgj3b8XS9XdLV2U8/
TLSH
T199231B003BE8C237F2BE4F78A8F26145467AF6636603D5491CC451DB5623FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

a61627434459b3e58c25963cabc1a9b0213d11a46ec01a640988ceab517e535e

mscoree

dotnet