asyncrat | 1607c34ec10ba368de7eccc1adcd51e2af079ad25d643a775b2f57bff0f5f570

Sharing

Copy URL Twitter E-mail

General

Target
1607c34ec10ba368de7eccc1adcd51e2af079ad25d643a775b2f57bff0f5f570
Size 45KB
Sample260905-x5ppsa1dmc
SHA256 1607c34ec10ba368de7eccc1adcd51e2af079ad25d643a775b2f57bff0f5f570
MD5 7f3e478db7b57ec859b9bf7b8d2e7ed8
SHA1 31f7c4139cc1ed5adab180e3943d412f452b5fc6
SHA512 6b99ba424e1b54d3682dbe5c06771706907ce34817327599feb5eb0a65dbcab46e8dc18ee0600561021f3239f7b410d8aaf3ee2651615e768a7f1f0b91b36b18
SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1eb3/GYjHuPInzjbKgX1imVk1q8yZXuHQxnBDZcx:RuxkJTgip2zL/3n3bdXkmVcq8yZXrBde
TLSH
T1A4232A003BE8822BF27E5FB8A9F22105467EF2637603D64D1CC451DB5723FC69A426E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexhihi.site:80
sexhihi.site:22
sexhihi.site:8080
sexhihi.site:8880
sexhihi.site:2052
sexhihi.site:2082
sexhihi.site:2086
sexhihi.site:2095
sexhihi.site:443
sexhihi.site:2053
sexhihi.site:2083
sexhihi.site:2087
sexhihi.site:2096
sexhihi.site:8443
www.sexhihi.site:80
www.sexhihi.site:22
www.sexhihi.site:8080
www.sexhihi.site:8880
www.sexhihi.site:2052
www.sexhihi.site:2082
www.sexhihi.site:2086
www.sexhihi.site:2095
www.sexhihi.site:443
www.sexhihi.site:2053
www.sexhihi.site:2083
www.sexhihi.site:2087
www.sexhihi.site:2096
www.sexhihi.site:8443
hacker.sexhihi.site:80
hacker.sexhihi.site:22
hacker.sexhihi.site:8080
hacker.sexhihi.site:8880
hacker.sexhihi.site:2052
hacker.sexhihi.site:2082
hacker.sexhihi.site:2086
hacker.sexhihi.site:2095
hacker.sexhihi.site:443
hacker.sexhihi.site:2053
hacker.sexhihi.site:2083
hacker.sexhihi.site:2087
hacker.sexhihi.site:2096
hacker.sexhihi.site:8443
mydoom.sexhihi.site:80
mydoom.sexhihi.site:22
mydoom.sexhihi.site:8080
mydoom.sexhihi.site:8880
mydoom.sexhihi.site:2052
mydoom.sexhihi.site:2082
mydoom.sexhihi.site:2086
mydoom.sexhihi.site:2095
mydoom.sexhihi.site:443
mydoom.sexhihi.site:2053
mydoom.sexhihi.site:2083
mydoom.sexhihi.site:2087
mydoom.sexhihi.site:2096
mydoom.sexhihi.site:8443

Mutex

vYXSXLmO1UyY

Attributes

delay
0
install
true
install_file
fx4hf59p.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1607c34ec10ba368de7eccc1adcd51e2af079ad25d643a775b2f57bff0f5f570

File Explorer

1607c34ec10ba368de7eccc1adcd51e2af079ad25d643a775b2f57bff0f5f570

.exe 45KB

1607c34ec10ba368de7eccc1adcd51e2af079ad25d643a775b2f57bff0f5f570

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1607c34ec10ba368de7eccc1adcd51e2af079ad25d643a775b2f57bff0f5f570
MD5 7f3e478db7b57ec859b9bf7b8d2e7ed8
SHA1 31f7c4139cc1ed5adab180e3943d412f452b5fc6
SHA512 6b99ba424e1b54d3682dbe5c06771706907ce34817327599feb5eb0a65dbcab46e8dc18ee0600561021f3239f7b410d8aaf3ee2651615e768a7f1f0b91b36b18
SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1eb3/GYjHuPInzjbKgX1imVk1q8yZXuHQxnBDZcx:RuxkJTgip2zL/3n3bdXkmVcq8yZXrBde
TLSH
T1A4232A003BE8822BF27E5FB8A9F22105467EF2637603D64D1CC451DB5723FC69A426E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

1607c34ec10ba368de7eccc1adcd51e2af079ad25d643a775b2f57bff0f5f570

mscoree

dotnet