asyncrat | 8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc

General

Target
8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc
Size 45KB
Sample261029-xyg2cset4z
SHA256 8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc
MD5 1c03c18c823e91ed1dfc8fd973d8802a
SHA1 69153f6dc52cf6b35b662b7c8fb2c696c979fc07
SHA512 8b7f1626d1c35731c1823014a8c9d05a9b83d4d989e07e6e67293a0a864a2d5ce3255e5f32faf6ab08cb24cb5c817feb1e53abcf32f41f039e5365977239a750
SSDEEP 768:ZuYART4Ir9LWU3NxCmo2qZYGXDahWKsjbdgX3imEJUBfrpcDZsf+:ZuYART4UA2J2+gKcbKXSmEJUBGdsf+
TLSH
T1582319003BE9812BF2BE4F7899F2614545BAF2633603D65D1CC8419B5613FC6CA52AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

rr88.gratis:443
rr88.gratis:8080
www.rr88.gratis:443
www.rr88.gratis:8080
c2.rr88.gratis:443
c2.rr88.gratis:8080
backdoor.rr88.gratis:443
backdoor.rr88.gratis:8080
rr88.channel:443
rr88.channel:8080
www.rr88.channel:443
www.rr88.channel:8080
c2.rr88.channel:443
c2.rr88.channel:8080
backdoor.rr88.channel:443
backdoor.rr88.channel:8080
rr888.co:443
rr888.co:8080
www.rr888.co:443
www.rr888.co:8080
c2.rr888.co:443
c2.rr888.co:8080
backdoor.rr888.co:443
backdoor.rr888.co:8080
rr88tv.com:443
rr88tv.com:8080
www.rr88tv.com:443
www.rr88tv.com:8080
c2.rr88tv.com:443
c2.rr88tv.com:8080
backdoor.rr88tv.com:443
backdoor.rr88tv.com:8080
rr88.health:443
rr88.health:8080
www.rr88.health:443
www.rr88.health:8080
c2.rr88.health:443
c2.rr88.health:8080
backdoor.rr88.health:443
backdoor.rr88.health:8080

Mutex

zRDBhZoBiLW3

Attributes

delay
0
install
false
install_folder
AppData

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc

File Explorer

8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc

.exe 45KB

8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc
MD5 1c03c18c823e91ed1dfc8fd973d8802a
SHA1 69153f6dc52cf6b35b662b7c8fb2c696c979fc07
SHA512 8b7f1626d1c35731c1823014a8c9d05a9b83d4d989e07e6e67293a0a864a2d5ce3255e5f32faf6ab08cb24cb5c817feb1e53abcf32f41f039e5365977239a750
SSDEEP 768:ZuYART4Ir9LWU3NxCmo2qZYGXDahWKsjbdgX3imEJUBfrpcDZsf+:ZuYART4UA2J2+gKcbKXSmEJUBGdsf+
TLSH
T1582319003BE9812BF2BE4F7899F2614545BAF2633603D65D1CC8419B5613FC6CA52AFA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

51694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc

mscoree

dotnet