asyncrat | df9d9c5fed7694fe53adb2806ff5c99fd41662c660cb5f4447ec9e5bff787294

Sharing

Copy URL Twitter E-mail

General

Target
df9d9c5fed7694fe53adb2806ff5c99fd41662c660cb5f4447ec9e5bff787294
Size 45KB
Sample260919-mphlessw3n
SHA256 df9d9c5fed7694fe53adb2806ff5c99fd41662c660cb5f4447ec9e5bff787294
MD5 3959265d8fe70b702c8a99063b493931
SHA1 4cff24e18e8aea350adc7a389e136e62c29c01a8
SHA512 9f2412c69da94e467c14afd8d5ef7bfe707cab100e28b633f73bedd4148cd35c23a499467ceb50740a2b8b6e9b4226c711756f36340d14e1c146a763f66151ba
SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlKm//GgrOPIm8zjbSgX3i/J6jUu59cBDZMx:wuDWZTpMZSB2BmHb3Z3bVXS/YjnMdMx
TLSH
T1D6231A003BE8822BF2BE4F789DF26145867AF2B36603D54A1CC451DB5613FC696426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vnsextop1.com:80
vnsextop1.com:22
vnsextop1.com:8080
vnsextop1.com:8880
vnsextop1.com:2052
vnsextop1.com:2082
vnsextop1.com:2086
vnsextop1.com:2095
vnsextop1.com:443
vnsextop1.com:2053
vnsextop1.com:2083
vnsextop1.com:2087
vnsextop1.com:2096
vnsextop1.com:8443
www.vnsextop1.com:80
www.vnsextop1.com:22
www.vnsextop1.com:8080
www.vnsextop1.com:8880
www.vnsextop1.com:2052
www.vnsextop1.com:2082
www.vnsextop1.com:2086
www.vnsextop1.com:2095
www.vnsextop1.com:443
www.vnsextop1.com:2053
www.vnsextop1.com:2083
www.vnsextop1.com:2087
www.vnsextop1.com:2096
www.vnsextop1.com:8443
industroyer.vnsextop1.com:80
industroyer.vnsextop1.com:22
industroyer.vnsextop1.com:8080
industroyer.vnsextop1.com:8880
industroyer.vnsextop1.com:2052
industroyer.vnsextop1.com:2082
industroyer.vnsextop1.com:2086
industroyer.vnsextop1.com:2095
industroyer.vnsextop1.com:443
industroyer.vnsextop1.com:2053
industroyer.vnsextop1.com:2083
industroyer.vnsextop1.com:2087
industroyer.vnsextop1.com:2096
industroyer.vnsextop1.com:8443
locky.vnsextop1.com:80
locky.vnsextop1.com:22
locky.vnsextop1.com:8080
locky.vnsextop1.com:8880
locky.vnsextop1.com:2052
locky.vnsextop1.com:2082
locky.vnsextop1.com:2086
locky.vnsextop1.com:2095
locky.vnsextop1.com:443
locky.vnsextop1.com:2053
locky.vnsextop1.com:2083
locky.vnsextop1.com:2087
locky.vnsextop1.com:2096
locky.vnsextop1.com:8443

Mutex

DKp0NJ8lpB3S

Attributes

delay
0
install
true
install_file
jcj0f.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df9d9c5fed7694fe53adb2806ff5c99fd41662c660cb5f4447ec9e5bff787294

File Explorer

df9d9c5fed7694fe53adb2806ff5c99fd41662c660cb5f4447ec9e5bff787294

.exe 45KB

df9d9c5fed7694fe53adb2806ff5c99fd41662c660cb5f4447ec9e5bff787294

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 df9d9c5fed7694fe53adb2806ff5c99fd41662c660cb5f4447ec9e5bff787294
MD5 3959265d8fe70b702c8a99063b493931
SHA1 4cff24e18e8aea350adc7a389e136e62c29c01a8
SHA512 9f2412c69da94e467c14afd8d5ef7bfe707cab100e28b633f73bedd4148cd35c23a499467ceb50740a2b8b6e9b4226c711756f36340d14e1c146a763f66151ba
SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlKm//GgrOPIm8zjbSgX3i/J6jUu59cBDZMx:wuDWZTpMZSB2BmHb3Z3bVXS/YjnMdMx
TLSH
T1D6231A003BE8822BF2BE4F789DF26145867AF2B36603D54A1CC451DB5613FC696426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

df9d9c5fed7694fe53adb2806ff5c99fd41662c660cb5f4447ec9e5bff787294

mscoree

dotnet