AsyncRAT PE Executable malware analysis – 68f9ac2efdeb

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Low

1 malicious · 3 files

EXE68f9ac2efdeb32296e7893e7a0434179AsyncRAT

Structure

BINResources

Config. Field	Value
Key (AES_256)	azY0Mkhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	Bkmymlhuhuhuhuhuhuhuhuhuhuhu
Install	fhuhuhuhu
BDOS	fhuhuhuhu
Anti-VM	fhuhuhuhu
Install-Folder	%Aphuhuhuhu
Hosts	2.tcphuhuhuhuhuhuhu
Ports	1huhuhuhu
Mutex	ch44huhuhuhu
Version	0huhuhuhu
Delay	3huhuhuhu
Group	Dehuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	fad.exe
Full Name	fad.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	fad.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	fad
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	69
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	26
Main IL	call System.Boolean Client.Settings::InitializeSettings() brtrue IL_000B: ldc.i4 3000 ret <null> ldc.i4 3000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Client.Helper.MutexControl::CreateMutex() pop <null> leave IL_0026: nop pop <null> leave IL_0026: nop nop <null> call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0037: nop pop <null> leave IL_0037: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_004C: leave IL_0057 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_0057: ldc.i4 5000 pop <null> leave IL_0057: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0037: nop
Module Name	fad.exe
Full Name	fad.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	fad.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	fad
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	69
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	26
Main IL	call System.Boolean Client.Settings::InitializeSettings() brtrue IL_000B: ldc.i4 3000 ret <null> ldc.i4 3000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Client.Helper.MutexControl::CreateMutex() pop <null> leave IL_0026: nop pop <null> leave IL_0026: nop nop <null> call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0037: nop pop <null> leave IL_0037: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_004C: leave IL_0057 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_0057: ldc.i4 5000 pop <null> leave IL_0057: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0037: nop

Key (AES_256) MUTEXmalicious

azY0Mkhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

2.tcphuhuhuhuhuhuhu

Ports PORTmalicious

1huhuhuhu

Mutex MUTEXmalicious

ch44huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential