asyncrat | 3d98c5e90e13be562fc8ca1af47a266aba95b40c7257413d1bb8eb556573c234

Sharing

Copy URL Twitter E-mail

General

Target
3d98c5e90e13be562fc8ca1af47a266aba95b40c7257413d1bb8eb556573c234
Size 45KB
Sample260907-w8l8ds1xev
SHA256 3d98c5e90e13be562fc8ca1af47a266aba95b40c7257413d1bb8eb556573c234
MD5 a81ab9cbd761ae6376f34fc4347f089e
SHA1 74578ecbac8ddaa161e34096aad3ee124a297dd7
SHA512 0962015ad2b255e647b355c003205a551704c519f9b7b277dee0f55d68af1c7e28ba0421b41e16c06872c487754ccb66026b83d73e931648919db9b3df5af87d
SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrrb3/GYjHuPInzjbtgXKiaQLyf7mQG+BDZkx:vuogpT7I62gL/3n3b6Xz92TmOdkx
TLSH
T12E233B003BE9C127F2BE4FB898F26146467AF6636603D64D2CC452DB5613FC29A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

clip-cuchot.net:80
clip-cuchot.net:22
clip-cuchot.net:8080
clip-cuchot.net:8880
clip-cuchot.net:2052
clip-cuchot.net:2082
clip-cuchot.net:2086
clip-cuchot.net:2095
clip-cuchot.net:443
clip-cuchot.net:2053
clip-cuchot.net:2083
clip-cuchot.net:2087
clip-cuchot.net:2096
clip-cuchot.net:8443
www.clip-cuchot.net:80
www.clip-cuchot.net:22
www.clip-cuchot.net:8080
www.clip-cuchot.net:8880
www.clip-cuchot.net:2052
www.clip-cuchot.net:2082
www.clip-cuchot.net:2086
www.clip-cuchot.net:2095
www.clip-cuchot.net:443
www.clip-cuchot.net:2053
www.clip-cuchot.net:2083
www.clip-cuchot.net:2087
www.clip-cuchot.net:2096
www.clip-cuchot.net:8443
lokibot.clip-cuchot.net:80
lokibot.clip-cuchot.net:22
lokibot.clip-cuchot.net:8080
lokibot.clip-cuchot.net:8880
lokibot.clip-cuchot.net:2052
lokibot.clip-cuchot.net:2082
lokibot.clip-cuchot.net:2086
lokibot.clip-cuchot.net:2095
lokibot.clip-cuchot.net:443
lokibot.clip-cuchot.net:2053
lokibot.clip-cuchot.net:2083
lokibot.clip-cuchot.net:2087
lokibot.clip-cuchot.net:2096
lokibot.clip-cuchot.net:8443
gootloader.clip-cuchot.net:80
gootloader.clip-cuchot.net:22
gootloader.clip-cuchot.net:8080
gootloader.clip-cuchot.net:8880
gootloader.clip-cuchot.net:2052
gootloader.clip-cuchot.net:2082
gootloader.clip-cuchot.net:2086
gootloader.clip-cuchot.net:2095
gootloader.clip-cuchot.net:443
gootloader.clip-cuchot.net:2053
gootloader.clip-cuchot.net:2083
gootloader.clip-cuchot.net:2087
gootloader.clip-cuchot.net:2096
gootloader.clip-cuchot.net:8443
remote.clip-cuchot.net:80
remote.clip-cuchot.net:22
remote.clip-cuchot.net:8080
remote.clip-cuchot.net:8880
remote.clip-cuchot.net:2052
remote.clip-cuchot.net:2082
remote.clip-cuchot.net:2086
remote.clip-cuchot.net:2095
remote.clip-cuchot.net:443
remote.clip-cuchot.net:2053
remote.clip-cuchot.net:2083
remote.clip-cuchot.net:2087
remote.clip-cuchot.net:2096
remote.clip-cuchot.net:8443
client.clip-cuchot.net:80
client.clip-cuchot.net:22
client.clip-cuchot.net:8080
client.clip-cuchot.net:8880
client.clip-cuchot.net:2052
client.clip-cuchot.net:2082
client.clip-cuchot.net:2086
client.clip-cuchot.net:2095
client.clip-cuchot.net:443
client.clip-cuchot.net:2053
client.clip-cuchot.net:2083
client.clip-cuchot.net:2087
client.clip-cuchot.net:2096
client.clip-cuchot.net:8443

Mutex

BZ5voUuiHLFO

Attributes

delay
0
install
true
install_file
kldsompo.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d98c5e90e13be562fc8ca1af47a266aba95b40c7257413d1bb8eb556573c234

File Explorer

3d98c5e90e13be562fc8ca1af47a266aba95b40c7257413d1bb8eb556573c234

.exe 45KB

3d98c5e90e13be562fc8ca1af47a266aba95b40c7257413d1bb8eb556573c234

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3d98c5e90e13be562fc8ca1af47a266aba95b40c7257413d1bb8eb556573c234
MD5 a81ab9cbd761ae6376f34fc4347f089e
SHA1 74578ecbac8ddaa161e34096aad3ee124a297dd7
SHA512 0962015ad2b255e647b355c003205a551704c519f9b7b277dee0f55d68af1c7e28ba0421b41e16c06872c487754ccb66026b83d73e931648919db9b3df5af87d
SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrrb3/GYjHuPInzjbtgXKiaQLyf7mQG+BDZkx:vuogpT7I62gL/3n3b6Xz92TmOdkx
TLSH
T12E233B003BE9C127F2BE4FB898F26146467AF6636603D64D2CC452DB5613FC29A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

3d98c5e90e13be562fc8ca1af47a266aba95b40c7257413d1bb8eb556573c234

mscoree

dotnet