hoiquantv.online.exe
AsyncRAT remote access trojan
AsyncRAT .NET RAT payload with MessagePack C2 framingMessagePack tasking loads and invokes a managed plugin
SHA-256fb64197670bbd94246e5b9f897a750db4dff3dc3b7081e97d185c2256720545b
Evidence
0x3b742e00001173d000000a0a028e69284a00....s.......i(J.
0x3b84000a0b0607161a6f4c00000a0617730a.......oL.....s.
0x3b9401000a0c080216028e696f4c00000a08.........ioL....
0x3ba46f4f00000add0d000000083906000000oO.........9....
0x3bb4086f3300000adc066fdd00000a0ddd0d.o3.....o.......
0x3bc4000000063906000000066f3300000adc....9.....o3....
0x3bd4092a0000011c0000020020001636000d.*........ ..6..
0x3be40000000002000600494f000d00000000........IO......
0x3bf442534a4201000100000000000c000000BSJB............
0x3c0476342e302e3330333139000000000500v4.0.30319......
0x3c146c000000bc1d0000237e0000281e0000l.......#~..(...
0x3c24d01d000023537472696e677300000000....#Strings....
0x3c34f83b0000e027000023555300d8630000.;...'..#US..c..
0x3c44100000002347554944000000e8630000....#GUID....c..
0x3c544009000023426c6f6200000000000000@...#Blob.......
0x3c6402000000579fa23f090a000000fa2533....W..?......%3
0x3c7400160000010000009b0000001e000000................
0x3c8447000000a30000007100000002000000G.......q.......
0x3c940a010000130000003100000002000000........1.......
0x3ca42e000000040000001300000020000000............ ...
0x3cb404000000030000000600000006000000................
0x3cc402000000010000000800000004000000................
0x3cd4010000000000fb0a0100000000000600................
0x3ce44f1904100a008a0019160a00b5198818O...............
0x3cf40a009f0f ....
0x5beb535f444953504c41595f524551554952S_DISPLAY_REQUIR
0x5bfb4544004d61704e616d65546f4f494400ED.MapNameToOID.
0x5c0b48574944006765745f466f726d617449HWID.get_FormatI
0x5c1b4400455845435554494f4e5f53544154D.EXECUTION_STAT
0x5c2b45003837363339313236454137374233E.87639126EA77B3
0x5c3b3538463236353332333637444241363758F26532367DBA67
0x5c4b43353331304546353041384439383838C5310EF50A8D9888
0x5c5b45443037304344343045314636303541ED070CD40E1F605A
0x5c6b3846006765745f4153434949005379738F.get_ASCII.Sys
0x5c7b74656d2e494f00497358500042444f53tem.IO.IsXP.BDOS
0x5c8b0045535f434f4e54494e554f55530067.ES_CONTINUOUS.g
0x5c9b65745f4956007365745f49560047656eet_IV.set_IV.Gen
0x5cab65726174654956004d54580076616c75erateIV.MTX.valu
0x5cbb655f5f00526561645365727665727444e__.ReadServertD
0x5ccb6174610064617461006d73636f726c69ata.data.mscorli
0x5cdb620053797374656d2e436f6c6c656374b.System.Collect
0x5ceb696f6e732e47656e65726963004d6963ions.Generic.Mic
0x5cfb726f736f66742e56697375616c426173rosoft.VisualBas
0x5d0b6963006765745f53656e6453796e6300ic.get_SendSync.
0x5d1b456e645265616400426567696e526561EndRead.BeginRea
0x5d2b6400546872656164004c6f616400496ed.Thread.Load.In
0x5d3b6e6572416464005348413235364d616enerAdd.SHA256Man
0x5d4b61676564006765745f436f6e6e656374aged.get_Connect
0x5d5b6564006765745f4973436f6e6e656374ed.get_IsConnect
0x5d6b6564007365745f4973436f6e6e656374ed.set_IsConnect
0x5d7b6564005265636569766564006765745fed.Received.get_
0x5d8b477569640048776964003c53656e6453Guid.Hwid.<SendS
0x5d9b796e633e6b5f5f4261636b696e674669ync>k__BackingFi
0x5dab656c64003c4973436f6e6e6563746564eld.<IsConnected
0x5dbb3e6b5f5f4261636b696e674669656c64>k__BackingField
0x5dcb003c4b656570416c6976653e6b5f5f42.<KeepAlive>k__B
0x5ddb61636b696e674669656c64003c486561ackingField.<Hea
0x5deb64657253697a653e6b5f5f4261636b69derSize>k__Backi
0x5dfb6e674669656c64003c50696e673e6b5fngField.<Ping>k_
0x5e0b5f4261636b696e674669656c64003c41_BackingField.<A
0x5e1b63746976617465506f6e673e6b5f5f42ctivatePong>k__B
0x5e2b61636b696e674669656c64003c496e74ackingField.<Int
0x5e3b657276616c3e6b5f5f4261636b696e67erval>k__Backing
0x5e4b4669656c64003c4275666665723e6b5fField.<Buffer>k_
0x5e5b5f4261636b696e674669656c64003c4f_BackingField.<O
0x5e6b66667365743e6b5f5f4261636b696e67ffset>k__Backing
0x5e7b4669656c64003c53736c436c69656e74Field.<SslClient
0x5e8b3e6b5f5f4261636b696e674669656c64>k__BackingField
0x5e9b003c546370436c69656e743e6b5f5f42.<TcpClient>k__B
0x5eab61636b696e674669656c6400496e6e65ackingField.Inne
0x5ebb724164644d61704368696c6400496e6erAddMapChild.Inn
0x5ecb657241646441727261794368696c6400erAddArrayChild.
0x5edb68576e640053656e6400417070656e64hWnd.Send.Append
0x61b8744e616d65006e616d65004461746554tName.name.DateT
0x61c8696d65006765745f4c61737457726974ime.get_LastWrit
0x61d86554696d6500546f556e697665727361eTime.ToUniversa
0x61e86c54696d650057726974654c696e6500lTime.WriteLine.
0x61f8436f6d62696e6500686f697175616e74Combine.hoiquant
0x6208762e6f6e6c696e6500557269486f7374v.online.UriHost
0x62184e616d6554797065006765745f56616cNameType.get_Val
0x62287565547970650076616c756554797065ueType.valueType
0x6238004d73675061636b547970650050726f.MsgPackType.Pro
0x6248746f636f6c5479706500476574547970tocolType.GetTyp
0x62586500536f636b6574547970650046696ce.SocketType.Fil
0x62686553686172650053797374656d2e436feShare.System.Co
0x62787265005365727665727369676e617475re.Serversignatu
0x6288726500436c6f736500446973706f7365re.Close.Dispose
0x629800506172736500537472526576657273.Parse.StrRevers
0x62a865005835303943657274696669636174e.X509Certificat
0x62b8650056616c6964617465536572766572e.ValidateServer
0x62c843657274696669636174650063657274Certificate.cert
0x62d869666963617465004372656174650053ificate.Create.S
0x62e86574546872656164457865637574696fetThreadExecutio
0x62f86e53746174650044656c657465004361nState.Delete.Ca
0x63086c6c5369746500577269746500436f6dllSite.Write.Com
0x631870696c657247656e6572617465644174pilerGeneratedAt
0x632874726962757465004465627567676162tribute.Debuggab
0x63386c6541747472696275746500436f6d56leAttribute.ComV
0x6348697369626c6541747472696275746500isibleAttribute.
0x6358417373656d626c795469746c65417474AssemblyTitleAtt
0x636872696275746500417373656d626c7954ribute.AssemblyT
0x6378726164656d61726b4174747269627574rademarkAttribut
0x638865005461726765744672616d65776f72e.TargetFramewor
0x63986b41747472696275746500417373656dkAttribute.Assem
0x63a862 b
0x641e52656c61786174696f6e734174747269RelaxationsAttri
0x642e6275746500417373656d626c7950726fbute.AssemblyPro
0x643e64756374417474726962757465004173ductAttribute.As
0x644e73656d626c79436f7079726967687441semblyCopyrightA
0x645e747472696275746500417373656d626cttribute.Assembl
0x646e79436f6d70616e794174747269627574yCompanyAttribut
0x647e650052756e74696d65436f6d70617469e.RuntimeCompati
0x648e62696c69747941747472696275746500bilityAttribute.
0x649e7365745f5573655368656c6c45786563set_UseShellExec
0x64ae75746500526561644279746500577269ute.ReadByte.Wri
0x64be7465427974650044656c65746556616cteByte.DeleteVal
0x64ce756500696e6e657256616c7565004765ue.innerValue.Ge
0x64de7456616c75650053657456616c756500tValue.SetValue.
0x64ee76616c7565006765745f4b656570416cvalue.get_KeepAl
0x64fe697665007365745f4b656570416c6976ive.set_KeepAliv
0x650e650052656d6f766500686f697175616ee.Remove.hoiquan
0x651e74762e6f6e6c696e652e657865007365tv.online.exe.se
0x652e745f426c6f636b53697a65006765745ft_BlockSize.get_
0x653e546f74616c53697a65006765745f4865TotalSize.get_He
0x654e6164657253697a65007365745f486561aderSize.set_Hea
0x655e64657253697a65007365745f53656e64derSize.set_Send
0x656e42756666657253697a65007365745f52BufferSize.set_R
0x657e65636569766542756666657253697a65eceiveBufferSize
0x658e007365745f4b657953697a6500496e64.set_KeySize.Ind
0x659e65784f6600737472466c616700437279exOf.strFlag.Cry
0x65ae70746f436f6e666967006765745f5069ptoConfig.get_Pi
0x65be6e67007365745f50696e670053797374ng.set_Ping.Syst
0x65ce656d2e546872656164696e6700736574em.Threading.set
0x65de5f50616464696e67006164645f536573_Padding.add_Ses
0x65ee73696f6e456e64696e67005379737465sionEnding.Syste
0x65fe6d4576656e74735f53657373696f6e45mEvents_SessionE
0x660e6e64696e670055544638456e636f6469nding.UTF8Encodi
0x661e6e670053797374656d2e44726177696eng.System.Drawin
0x662e672e496d6167696e670053797374656dg.Imaging.System
0x663e2e52756e74696d652e56657273696f6e.Runtime.Version
0x664e696e670046726f6d4261736536345374ing.FromBase64St
0x665e72696e6700546f426173653634537472ring.ToBase64Str
0x666e696e670052656164537472696e670044ing.ReadString.D
0x667e6f776e6c6f6164537472696e67005772ownloadString.Wr
0x668e697465537472696e6700546f53747269iteString.ToStri
0x669e6e67006765745f4173537472696e6700ng.get_AsString.
0x66ae7365745f4173537472696e6700427974set_AsString.Byt
0x66be65734173537472696e67004765744173esAsString.GetAs
0x66ce537472696e6700536574417353747269String.SetAsStri
0x66de6e6700476574537472696e6700427974ng.GetString.Byt
0x66ee65734173486578537472696e67005375esAsHexString.Su
0x66fe62737472696e670053797374656d2e44bstring.System.D
0x670e726177696e67006765745f4163746976rawing.get_Activ
0x990332006c004e004f004200790066006d002.l.N.O.B.y.f.m.
0x991378006d002f0063003800460045003000x.m./.c.8.F.E.0.
0x9923770067006f0035004800720038003200w.g.o.5.H.r.8.2.
0x99336f002f0063007a0077003d003d000009o./.c.z.w.=.=...
0x99436e0075006c006c00000100033a00000dn.u.l.l.....:...
0x99535000610063006b006500740000095000P.a.c.k.e.t...P.
0x996369006e006700000f4d00650073007300i.n.g...M.e.s.s.
0x9973610067006500000763006d0064000069a.g.e...c.m.d..i
0x99832f006300200073006300680074006100/.c. .s.c.h.t.a.
0x999373006b00730020002f00630072006500s.k.s. ./.c.r.e.
0x99a361007400650020002f00660020002f00a.t.e. ./.f. ./.
0x99b37300630020006f006e006c006f006700s.c. .o.n.l.o.g.
0x99c36f006e0020002f0072006c0020006800o.n. ./.r.l. .h.
0x99d369006700680065007300740020002f00i.g.h.e.s.t. ./.
0x99e374006e00200022000011220020002f00t.n. ."...". ./.
0x99f374007200200027002200011322002700t.r. .'."...".'.
0x9a032000260020006500780069007400015d .&. .e.x.i.t..]
0x9a135c006e00750052005c006e006f006900\.n.u.R.\.n.o.i.
0x9a23730072006500560074006e0065007200s.r.e.V.t.n.e.r.
0x9a337200750043005c00730077006f006400r.u.C.\.s.w.o.d.
0x9a436e00690057005c00740066006f007300n.i.W.\.t.f.o.s.
0x9a536f007200630069004d005c0065007200o.r.c.i.M.\.e.r.
0x9a6361007700740066006f00530000032200a.w.t.f.o.S...".
0x9a83630068006f0020006f0066006600001fc.h.o. .o.f.f...
0x9a93740069006d0065006f00750074002000t.i.m.e.o.u.t. .
0x9aa3330020003e0020004e0055004c0000153. .>. .N.U.L...
0x9ab353005400410052005400200022002200S.T.A.R.T. .".".
0x9ac3200022000007430044002000000b4400 ."...C.D. ...D.
0x9ad345004c0020002200000f220020002f00E.L. ."...". ./.
0x9ae3660020002f0071000005780070000045f. ./.q...x.p..E
0x9af3530065006c0065006300740020002a00S.e.l.e.c.t. .*.
0x9b032000660072006f006d00200057006900 .f.r.o.m. .W.i.
0x9b136e00330032005f0043006f006d007000n.3.2._.C.o.m.p.
0x9b2375007400650072005300790073007400u.t.e.r.S.y.s.t.
0x9b3365006d0000194d0061006e0075006600e.m...M.a.n.u.f.
0x9b436100630074007500720065007200002ba.c.t.u.r.e.r..+
0x9b536d006900630072006f0073006f006600m.i.c.r.o.s.o.f.
0x9b637400200063006f00720070006f007200t. .c.o.r.p.o.r.
0x9b736100740069006f006e00000b4d006f00a.t.i.o.n...M.o.
0x9b83640065006c00000f5600490052005400d.e.l...V.I.R.T.
0x9b93550041004c00000d76006d0077006100U.A.L...v.m.w.a.
0x9ba372006500001556006900720074007500r.e...V.i.r.t.u.
0x9bb361006c0042006f007800001753006200a.l.B.o.x...S.b.
0x9bc36900650044006c006c002e0064006c00i.e.D.l.l...d.l.
0x9bd36c000011450072007200200048005700l...E.r.r. .H.W.
0x9be349004400000578003200001543006c00I.D...x.2...C.l.
0x9bf3690065006e00740049006e0066006f00i.e.n.t.I.n.f.o.