AsyncRAT PE Executable malware analysis – 4f6a938c673e

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

High

1 malicious · 10 files

EXE4f6a938c673e34cae29f6372ab72d9cfAsyncRAT

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Key (AES_256)	dnBRQmhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	iEe5Kthuhuhuhuhuhuhuhuhuhuhu
Install	fhuhuhuhu
BDOS	fhuhuhuhu
Anti-VM	fhuhuhuhu
Install-Folder	%Aphuhuhuhu
Version	0.huhuhuhu
Hosts	andreshuhuhuhuhuhuhuhuhuhuhu
Ports	8huhuhuhu
Mutex	Asynchuhuhuhuhuhuhu
Delay	3huhuhuhu
Group	ANDREhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	SERVERANDRESPEREZ222.exe
Full Name	SERVERANDRESPEREZ222.exe
EntryPoint	System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Scope Name	SERVERANDRESPEREZ222.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	SERVERANDRESPEREZ222
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	135
Main Method	System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Main IL Instruction Count	3
Main IL	`call System.Void hyBi4B7CHOZ0PcM2da.BrEOWILUFmZ9AtRTw7::lLHifFIsCLsZtjvFfN0i() call System.Void Client.Program::Main() ret <null>`
Module Name	SERVERANDRESPEREZ222.exe
Full Name	SERVERANDRESPEREZ222.exe
EntryPoint	System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Scope Name	SERVERANDRESPEREZ222.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	SERVERANDRESPEREZ222
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	135
Main Method	System.Void <PrivateImplementationDetails>{C9D51624-7BE3-4530-BBD7-5A7744545664}::Main()
Main IL Instruction Count	3
Main IL	`call System.Void hyBi4B7CHOZ0PcM2da.BrEOWILUFmZ9AtRTw7::lLHifFIsCLsZtjvFfN0i() call System.Void Client.Program::Main() ret <null>`

Key (AES_256) MUTEXmalicious

dnBRQmhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

andreshuhuhuhuhuhuhuhuhuhuhu

Ports PORTmalicious

8huhuhuhu

Mutex MUTEXmalicious

Asynchuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential