asyncrat | 81225ba3144bbb43a08015ac4a6e38ba[.]exe

General

Target
81225ba3144bbb43a08015ac4a6e38ba.exe
Size 45KB
Sample260912-1ts5lsaf82
SHA256 7444bc81a91d057d47297ced59b71e216b5dd1b1c348d4587eeec9b589f962b2
MD5 4c58a493af99d1547f1479dad41666d3
SHA1 91398f472edc1a65cb736598b78728806b237ebd
SHA512 0ae8a5ebfcc5968f1c605cbae3f34aa604c03183bfc21d8737d1ddc996fa668541739416d62feb4569271e95d618df0cd7020bf91a9ae6c63434d612a299a40a
SSDEEP 768:gu/mkuTMUzwJbWUnBtJmo2qVeOoXlUPIleUjbrgX3iTbx+cEHz/u0ZEBDZ8x:gu/mkuTMzX2b5VZM0bUXSTdVEHz/u0Z1
TLSH
T14F233A1037E98127F2BE4F789DF26145467AF6672603D64E2CC4029B5723FC29A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat admin asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Admin

C2

phimsexz.pro:80
phimsexz.pro:443
phimsexz.pro:7788
phimsexz.pro:7879
phimsexz.pro:3577
phimsexz.pro:8888
phimsexz.pro:3306
phimsexz.pro:21
phimsexz.pro:22
www.phimsexz.pro:80
www.phimsexz.pro:443
www.phimsexz.pro:7788
www.phimsexz.pro:7879
www.phimsexz.pro:3577
www.phimsexz.pro:8888
www.phimsexz.pro:3306
www.phimsexz.pro:21
www.phimsexz.pro:22
malware.phimsexz.pro:80
malware.phimsexz.pro:443
malware.phimsexz.pro:7788
malware.phimsexz.pro:7879
malware.phimsexz.pro:3577
malware.phimsexz.pro:8888
malware.phimsexz.pro:3306
malware.phimsexz.pro:21
malware.phimsexz.pro:22
ssh.phimsexz.pro:80
ssh.phimsexz.pro:443
ssh.phimsexz.pro:7788
ssh.phimsexz.pro:7879
ssh.phimsexz.pro:3577
ssh.phimsexz.pro:8888
ssh.phimsexz.pro:3306
ssh.phimsexz.pro:21
ssh.phimsexz.pro:22
5.61.208.88:80
5.61.208.88:443
5.61.208.88:7788
5.61.208.88:7879
5.61.208.88:3577
5.61.208.88:8888
5.61.208.88:3306
5.61.208.88:21
5.61.208.88:22

Mutex

hitOrjYMZEgK

Attributes

delay
3
install
true
install_file
81225ba3144bbb43a08015ac4a6e38ba.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81225ba3144bbb43a08015ac4a6e38ba.exe

File Explorer

81225ba3144bbb43a08015ac4a6e38ba.exe

.exe 45KB

81225ba3144bbb43a08015ac4a6e38ba.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7444bc81a91d057d47297ced59b71e216b5dd1b1c348d4587eeec9b589f962b2
MD5 4c58a493af99d1547f1479dad41666d3
SHA1 91398f472edc1a65cb736598b78728806b237ebd
SHA512 0ae8a5ebfcc5968f1c605cbae3f34aa604c03183bfc21d8737d1ddc996fa668541739416d62feb4569271e95d618df0cd7020bf91a9ae6c63434d612a299a40a
SSDEEP 768:gu/mkuTMUzwJbWUnBtJmo2qVeOoXlUPIleUjbrgX3iTbx+cEHz/u0ZEBDZ8x:gu/mkuTMzX2b5VZM0bUXSTdVEHz/u0Z1
TLSH
T14F233A1037E98127F2BE4F789DF26145467AF6672603D64E2CC4029B5723FC29A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

51246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

81225ba3144bbb43a08015ac4a6e38ba.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

81225ba3144bbb43a08015ac4a6e38ba.exe

mscoree

dotnet