AsyncRAT PE Executable malware analysis – 8ae944b66073

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Low

1 malicious · 3 files

EXE8ae944b6607302cb32a82b02074c997aAsyncRAT

Structure

BINResources

Config. Field	Value
Key (AES_256)	ZHRnVHhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE6jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	Fzkxdkhuhuhuhuhuhuhuhuhuhuhu
Install	fhuhuhuhu
BDOS	fhuhuhuhu
Anti-VM	thuhuhuhu
Install-Folder	%Aphuhuhuhu
Hosts	199.huhuhuhuhuhuhu
Ports	9huhuhuhu
Mutex	Asynchuhuhuhuhuhuhu
Delay	3huhuhuhu
Group	fhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	AsyncClient.exe
Full Name	AsyncClient.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	AsyncClient.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsyncClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	412
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	50
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: call System.Void Client.Helper.Methods::PreventSleep() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.Methods::PreventSleep() ldnull <null> ldftn System.Void Client.Helper.Methods::LastAct() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldsfld System.String Client.Settings::offlineKL call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0083: leave IL_008E ldnull <null> ldftn System.Void Client.Helper.LimeLogger::callk() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() leave IL_008E: nop pop <null> leave IL_008E: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00A3: leave IL_00AE call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00AE: ldc.i4 6000 pop <null> leave IL_00AE: ldc.i4 6000 ldc.i4 6000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_008E: nop
Module Name	AsyncClient.exe
Full Name	AsyncClient.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	AsyncClient.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsyncClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	412
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	50
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: call System.Void Client.Helper.Methods::PreventSleep() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.Methods::PreventSleep() ldnull <null> ldftn System.Void Client.Helper.Methods::LastAct() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldsfld System.String Client.Settings::offlineKL call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0083: leave IL_008E ldnull <null> ldftn System.Void Client.Helper.LimeLogger::callk() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() leave IL_008E: nop pop <null> leave IL_008E: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00A3: leave IL_00AE call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00AE: ldc.i4 6000 pop <null> leave IL_00AE: ldc.i4 6000 ldc.i4 6000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_008E: nop

Key (AES_256) MUTEXmalicious

ZHRnVHhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

199.huhuhuhuhuhuhu

Ports PORTmalicious

9huhuhuhu

Mutex MUTEXmalicious

Asynchuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential