asyncrat | 61ed65bf5f0fa4997db2c125c660b400_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
61ed65bf5f0fa4997db2c125c660b400_NeikiAnalytics.exe
Size 62KB
Sample240618-2y24rasgnm
SHA256 8e6fbc3df724d831ac07ca254998e119f8cb9e7715caf7beffe2ad7e07a18fcc
MD5 61ed65bf5f0fa4997db2c125c660b400
SHA1 078f544ddab26e3256b4a578776a900e81145509
SHA512 0116134f725c9de1f858fec01471d7be6ed055f97114b572d0171fce3ca08288d3fdbc424113c3f315d9b8b8bf238a366c23fad819975ccefbf19d3320e2d512
SSDEEP 1536:XuPfZTgKa25kb/xxsbMdfeqmBTbRr0sQd4xb9weUU:XuPBTgKa254/xqbMd2hb9Kyxb9I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

paris-disciplinary.gl.at.ply.gg:666

Mutex

TnvdM3O6Wmgg

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Asyncrat family
asyncrat

File Explorer

61ed65bf5f0fa4997db2c125c660b400_NeikiAnalytics.exe

.exe 62KB

61ed65bf5f0fa4997db2c125c660b400_NeikiAnalytics.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8e6fbc3df724d831ac07ca254998e119f8cb9e7715caf7beffe2ad7e07a18fcc
MD5 61ed65bf5f0fa4997db2c125c660b400
SHA1 078f544ddab26e3256b4a578776a900e81145509
SHA512 0116134f725c9de1f858fec01471d7be6ed055f97114b572d0171fce3ca08288d3fdbc424113c3f315d9b8b8bf238a366c23fad819975ccefbf19d3320e2d512
SSDEEP 1536:XuPfZTgKa25kb/xxsbMdfeqmBTbRr0sQd4xb9weUU:XuPBTgKa254/xqbMd2hb9Kyxb9I
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Async RAT payload

rat

PE Signature issue

Digest

29:9b:4b:94:65:21:13:7d:d0:8c:21:a9:ea:1f:c1:db:42:e7:03:68:75:d4:17:58:ac:a8:ec:0d:c9:40:90:ee

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Chains

Apr 3, 2020

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

47:34:0e:b7:44:ca:d3:83:c2:09:ba:64:88:06:20:ad:c6:1b:b0:36

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Chains

Apr 3, 2020

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 22, 2019 - Feb 4, 2023

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 22, 2019 - Feb 4, 2023

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Serial Number

33:90:20:77:61:c4:26:dd:94:50:03:0d

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

53294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

61ed65bf5f0fa4997db2c125c660b400_NeikiAnalytics.exe

PE Signature issue

PE Signature issue

mscoree

dotnet