asyncrat | asmdbnasd[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
asmdbnasd.exe
Size 45KB
Sample260910-m3htcagf34
SHA256 43631de047adaf5469f8472f7e8a6dc8c77ecf61834bb33e98deabea277a0361
MD5 54a9bee021677710446dfdd9773fd46b
SHA1 25881fd5d20deed42a32bbc826f64cefb2d4ca27
SHA512 46d6198873f798bed743b445093ebf8fc16347998f9562a744a4a065177deea4f5683c22758b7e090585728d12e56187d62594c3bd47d2c9c2ae0f1db3f44da2
SSDEEP 768:IujGZTUwQm6WUA5zvUmo2qlnEsSmrZanPIwujbJgX3itn7Z6Z3qrIrUBDZLx:IujGZTULAG2Psp4AwCbGXSV7ZS3pridF
TLSH
T112233B003BE8812BF2BE4F78ACF26245467AF5673603D9491CC4519B5723FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat admin asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Admin

sexlonto.net:80
sexlonto.net:443
sexlonto.net:7788
sexlonto.net:7879
sexlonto.net:3577
sexlonto.net:8888
sexlonto.net:3306
sexlonto.net:21
sexlonto.net:22
www.sexlonto.net:80
www.sexlonto.net:443
www.sexlonto.net:7788
www.sexlonto.net:7879
www.sexlonto.net:3577
www.sexlonto.net:8888
www.sexlonto.net:3306
www.sexlonto.net:21
www.sexlonto.net:22
ssh.sexlonto.net:80
ssh.sexlonto.net:443
ssh.sexlonto.net:7788
ssh.sexlonto.net:7879
ssh.sexlonto.net:3577
ssh.sexlonto.net:8888
ssh.sexlonto.net:3306
ssh.sexlonto.net:21
ssh.sexlonto.net:22
ftp.sexlonto.net:80
ftp.sexlonto.net:443
ftp.sexlonto.net:7788
ftp.sexlonto.net:7879
ftp.sexlonto.net:3577
ftp.sexlonto.net:8888
ftp.sexlonto.net:3306
ftp.sexlonto.net:21
ftp.sexlonto.net:22
ssl.sexlonto.net:80
ssl.sexlonto.net:443
ssl.sexlonto.net:7788
ssl.sexlonto.net:7879
ssl.sexlonto.net:3577
ssl.sexlonto.net:8888
ssl.sexlonto.net:3306
ssl.sexlonto.net:21
ssl.sexlonto.net:22
malware.sexlonto.net:80
malware.sexlonto.net:443
malware.sexlonto.net:7788
malware.sexlonto.net:7879
malware.sexlonto.net:3577
malware.sexlonto.net:8888
malware.sexlonto.net:3306
malware.sexlonto.net:21
malware.sexlonto.net:22

Mutex

oIHNGyCwo5YJ

Attributes

delay
3
install
true
install_file
asmdbnasd.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
asmdbnasd.exe

File Explorer

asmdbnasd.exe

.exe 45KB

asmdbnasd.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 43631de047adaf5469f8472f7e8a6dc8c77ecf61834bb33e98deabea277a0361
MD5 54a9bee021677710446dfdd9773fd46b
SHA1 25881fd5d20deed42a32bbc826f64cefb2d4ca27
SHA512 46d6198873f798bed743b445093ebf8fc16347998f9562a744a4a065177deea4f5683c22758b7e090585728d12e56187d62594c3bd47d2c9c2ae0f1db3f44da2
SSDEEP 768:IujGZTUwQm6WUA5zvUmo2qlnEsSmrZanPIwujbJgX3itn7Z6Z3qrIrUBDZLx:IujGZTULAG2Psp4AwCbGXSV7ZS3pridF
TLSH
T112233B003BE8812BF2BE4F78ACF26245467AF5673603D9491CC4519B5723FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

asmdbnasd.exe

mscoree

dotnet