asyncrat | AsyncClient[.]exe

Target
AsyncClient.exe
Size 45KB
Sample261003-wamfhatdrf
SHA256 cbedcca6956457e43397a42f31cd90b9eb4160ca24ff96fa59fba34ce0b03e30
MD5 8543cda2d2955099f1f2b95dd8ac4fe4
SHA1 246e7b73c9ddddcf3ff32efc85eb433302897621
SHA512 c6864f2e848b598d2552f48cd1efa7f3550ba5b701b07b09157f9c953af450677eee5db6a9ec08d35be0fea009ff86c67135d47c2fc3ebfb319540626d1cc62d
SSDEEP 768:RuyN5TdMhGqWU8Durmo2qrlOjPGagAWOzjbFgX3il1sjzleIBevccDZqf+:RuyN5TdCf2kOTKTO3bCXSl0lTBWTdqf+
TLSH
T16B231B003BE9822BF2BE4F7899F26145867AF2632603D54E1CC451DB5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

echodex.io:6606
echodex.io:7707
echodex.io:8808
echodex.io:443
echodex.io:80
echodex.io:8844
echodex.io:22
echodex.io:53
popit.io:6606
popit.io:7707
popit.io:8808
popit.io:443
popit.io:80
popit.io:8844
popit.io:22
popit.io:53
www.pdf-books.org:6606
www.pdf-books.org:7707
www.pdf-books.org:8808
www.pdf-books.org:443
www.pdf-books.org:80
www.pdf-books.org:8844
www.pdf-books.org:22
www.pdf-books.org:53
skytrust.io:6606
skytrust.io:7707
skytrust.io:8808
skytrust.io:443
skytrust.io:80
skytrust.io:8844
skytrust.io:22
skytrust.io:53

Mutex

FtTRmAL1FxCo

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AsyncClient.exe

File Explorer

AsyncClient.exe

.exe 45KB

AsyncClient.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 cbedcca6956457e43397a42f31cd90b9eb4160ca24ff96fa59fba34ce0b03e30
MD5 8543cda2d2955099f1f2b95dd8ac4fe4
SHA1 246e7b73c9ddddcf3ff32efc85eb433302897621
SHA512 c6864f2e848b598d2552f48cd1efa7f3550ba5b701b07b09157f9c953af450677eee5db6a9ec08d35be0fea009ff86c67135d47c2fc3ebfb319540626d1cc62d
SSDEEP 768:RuyN5TdMhGqWU8Durmo2qrlOjPGagAWOzjbFgX3il1sjzleIBevccDZqf+:RuyN5TdCf2kOTKTO3bCXSl0lTBWTdqf+
TLSH
T16B231B003BE9822BF2BE4F7899F26145867AF2632603D54E1CC451DB5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

AsyncClient.exe

mscoree

dotnet