AsyncRAT PE Executable malware analysis – bd70f4ae62b5

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 9 files

EXEbd70f4ae62b55869b24a0f7c3d256d99AsyncRAT

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Key (AES_256)	TlJhdDhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	Bm+n4Xhuhuhuhuhuhuhuhuhuhuhu
Install	fhuhuhuhu
BDOS	fhuhuhuhu
Anti-VM	fhuhuhuhu
Hosts	edu.ushuhuhuhuhuhuhuhuhuhuhu
Ports	21,22,huhuhuhuhuhuhuhuhuhuhu
Mutex	0.huhuhuhu
Delay	5huhuhuhu
Group	J3GYhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	SYN-FLOOD.exe
Full Name	SYN-FLOOD.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	SYN-FLOOD.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	SYN-FLOOD
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	136
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	37
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0035: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0046: call System.Void Client.Helper.Methods::PreventSleep() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.Methods::PreventSleep() leave IL_0056: nop pop <null> leave IL_0056: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_006B: leave IL_0076 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_0076: ldc.i4 5000 pop <null> leave IL_0076: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_0056: nop
Module Name	SYN-FLOOD.exe
Full Name	SYN-FLOOD.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	SYN-FLOOD.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	SYN-FLOOD
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	136
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	37
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0035: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0046: call System.Void Client.Helper.Methods::PreventSleep() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.Methods::PreventSleep() leave IL_0056: nop pop <null> leave IL_0056: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_006B: leave IL_0076 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_0076: ldc.i4 5000 pop <null> leave IL_0076: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_0056: nop

Key (AES_256) MUTEXmalicious

TlJhdDhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

eduhuhuhuhu

CnC CNCmalicious

789behuhuhuhuhuhuhu

CnC CNCmalicious

bolohuhuhuhu

Ports PORTmalicious

2huhuhuhu

Ports PORTmalicious

2huhuhuhu

Ports PORTmalicious

4huhuhuhu

Ports PORTmalicious

6huhuhuhu

Ports PORTmalicious

7huhuhuhu

Ports PORTmalicious

8huhuhuhu

Ports PORTmalicious

8huhuhuhu

Mutex MUTEXmalicious

0.huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential