asyncrat | 4462b117e290d5ffb58771f076a7c92a3ea9de491b35fc4ade4a075c2d54d777

Sharing

Copy URL Twitter E-mail

General

Target
4462b117e290d5ffb58771f076a7c92a3ea9de491b35fc4ade4a075c2d54d777
Size 45KB
Sample260907-l7a4mathjh
SHA256 4462b117e290d5ffb58771f076a7c92a3ea9de491b35fc4ade4a075c2d54d777
MD5 0fc67541f90d1510a5827bb68a156157
SHA1 7d510c1dd68fbde69ddb5df9e198961f17bdb6c0
SHA512 be0e80cd7a0541277ebe5011ce6dc316c6e0030c35d25e5e1eb162d0a0def97f818207ebd649dcefc519e1204cc0d79b2a9a753f35dce43462482dddde4915ec
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyL5P02FUFdxYkk8PIKzjbkgX3iBbr6kpHlo7AsXBE:MuBGJTPho2/LDmWBK3brXSBnjputRdEx
TLSH
T14E232A0037E9C12BF2BE4F7469F26245867AF6633603D6491C8451DB5B13BC68A436EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

tvphimjapan.blog:80
tvphimjapan.blog:22
tvphimjapan.blog:8080
tvphimjapan.blog:8880
tvphimjapan.blog:2052
tvphimjapan.blog:2082
tvphimjapan.blog:2086
tvphimjapan.blog:2095
tvphimjapan.blog:443
tvphimjapan.blog:2053
tvphimjapan.blog:2083
tvphimjapan.blog:2087
tvphimjapan.blog:2096
tvphimjapan.blog:8443
www.tvphimjapan.blog:80
www.tvphimjapan.blog:22
www.tvphimjapan.blog:8080
www.tvphimjapan.blog:8880
www.tvphimjapan.blog:2052
www.tvphimjapan.blog:2082
www.tvphimjapan.blog:2086
www.tvphimjapan.blog:2095
www.tvphimjapan.blog:443
www.tvphimjapan.blog:2053
www.tvphimjapan.blog:2083
www.tvphimjapan.blog:2087
www.tvphimjapan.blog:2096
www.tvphimjapan.blog:8443
iloveyou.tvphimjapan.blog:80
iloveyou.tvphimjapan.blog:22
iloveyou.tvphimjapan.blog:8080
iloveyou.tvphimjapan.blog:8880
iloveyou.tvphimjapan.blog:2052
iloveyou.tvphimjapan.blog:2082
iloveyou.tvphimjapan.blog:2086
iloveyou.tvphimjapan.blog:2095
iloveyou.tvphimjapan.blog:443
iloveyou.tvphimjapan.blog:2053
iloveyou.tvphimjapan.blog:2083
iloveyou.tvphimjapan.blog:2087
iloveyou.tvphimjapan.blog:2096
iloveyou.tvphimjapan.blog:8443
conti.tvphimjapan.blog:80
conti.tvphimjapan.blog:22
conti.tvphimjapan.blog:8080
conti.tvphimjapan.blog:8880
conti.tvphimjapan.blog:2052
conti.tvphimjapan.blog:2082
conti.tvphimjapan.blog:2086
conti.tvphimjapan.blog:2095
conti.tvphimjapan.blog:443
conti.tvphimjapan.blog:2053
conti.tvphimjapan.blog:2083
conti.tvphimjapan.blog:2087
conti.tvphimjapan.blog:2096
conti.tvphimjapan.blog:8443
connect.tvphimjapan.blog:80
connect.tvphimjapan.blog:22
connect.tvphimjapan.blog:8080
connect.tvphimjapan.blog:8880
connect.tvphimjapan.blog:2052
connect.tvphimjapan.blog:2082
connect.tvphimjapan.blog:2086
connect.tvphimjapan.blog:2095
connect.tvphimjapan.blog:443
connect.tvphimjapan.blog:2053
connect.tvphimjapan.blog:2083
connect.tvphimjapan.blog:2087
connect.tvphimjapan.blog:2096
connect.tvphimjapan.blog:8443

Mutex

aHtxXNCjT4w9

Attributes

delay
0
install
true
install_file
us53.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4462b117e290d5ffb58771f076a7c92a3ea9de491b35fc4ade4a075c2d54d777

File Explorer

4462b117e290d5ffb58771f076a7c92a3ea9de491b35fc4ade4a075c2d54d777

.exe 45KB

4462b117e290d5ffb58771f076a7c92a3ea9de491b35fc4ade4a075c2d54d777

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4462b117e290d5ffb58771f076a7c92a3ea9de491b35fc4ade4a075c2d54d777
MD5 0fc67541f90d1510a5827bb68a156157
SHA1 7d510c1dd68fbde69ddb5df9e198961f17bdb6c0
SHA512 be0e80cd7a0541277ebe5011ce6dc316c6e0030c35d25e5e1eb162d0a0def97f818207ebd649dcefc519e1204cc0d79b2a9a753f35dce43462482dddde4915ec
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyL5P02FUFdxYkk8PIKzjbkgX3iBbr6kpHlo7AsXBE:MuBGJTPho2/LDmWBK3brXSBnjputRdEx
TLSH
T14E232A0037E9C12BF2BE4F7469F26245867AF6633603D6491C8451DB5B13BC68A436EE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

4462b117e290d5ffb58771f076a7c92a3ea9de491b35fc4ade4a075c2d54d777

mscoree

dotnet