asyncrat | 68600a644c03d75b94c44df3bc908e49974bd01f514aa18bdec7c5c332132302[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
68600a644c03d75b94c44df3bc908e49974bd01f514aa18bdec7c5c332132302.exe
Size 50KB
Sample241103-de2rwasmex
SHA256 68600a644c03d75b94c44df3bc908e49974bd01f514aa18bdec7c5c332132302
MD5 d111009bf7fd08969f36e3616fcb50b1
SHA1 1ba91424a608a3e60d33302264e54812d78dc00b
SHA512 7f3a66d539e22d779f45144ac09153d70b64e77d3f94f8ff33ccd5c0a356eddd0a49de9defe9bf9579021c3d2f3ddc4c75c8df3ae25d0a97cda0688646fe237e
SSDEEP 768:+8vehoRetRgxhsCaYeb85Dv7Cbz+T28Ps1dX0HvbKvYSX0bUeok0QsVOK6OfwJA3:+8mhietREQJa28PsybVfbU9hVu9t9Mx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat 2023_cdt asyncrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

2023_CDT

chromedata.accesscam.org:7707
chromedata.accesscam.org:4404
chromedata.accesscam.org:5505
chromedata.accesscam.org:3303
chromedata.accesscam.org:2222
chromedata.accesscam.org:6606
chromedata.accesscam.org:8808
chromedata.accesscam.org:5155
chromedata.accesscam.org:5122
chromedata.accesscam.org:8001
chromedata.accesscam.org:9000
chromedata.accesscam.org:9999
chromedata.accesscam.org:8888
adobedata.webredirect.org:7707
adobedata.webredirect.org:4404
adobedata.webredirect.org:5505
adobedata.webredirect.org:3303
adobedata.webredirect.org:2222
adobedata.webredirect.org:6606
adobedata.webredirect.org:8808
adobedata.webredirect.org:5155
adobedata.webredirect.org:5122
adobedata.webredirect.org:8001
adobedata.webredirect.org:9000
adobedata.webredirect.org:9999
adobedata.webredirect.org:8888
127.0.0.1:7707
127.0.0.1:4404
127.0.0.1:5505
127.0.0.1:3303
127.0.0.1:2222
127.0.0.1:6606
127.0.0.1:8808
127.0.0.1:5155
127.0.0.1:5122
127.0.0.1:8001
127.0.0.1:9000
127.0.0.1:9999
127.0.0.1:8888
dimascu.duckdns.org:7707
dimascu.duckdns.org:4404
dimascu.duckdns.org:5505
dimascu.duckdns.org:3303
dimascu.duckdns.org:2222
dimascu.duckdns.org:6606
dimascu.duckdns.org:8808
dimascu.duckdns.org:5155
dimascu.duckdns.org:5122
dimascu.duckdns.org:8001
dimascu.duckdns.org:9000
dimascu.duckdns.org:9999
dimascu.duckdns.org:8888
cdt2023.ddns.net:7707
cdt2023.ddns.net:4404
cdt2023.ddns.net:5505
cdt2023.ddns.net:3303
cdt2023.ddns.net:2222
cdt2023.ddns.net:6606
cdt2023.ddns.net:8808
cdt2023.ddns.net:5155
cdt2023.ddns.net:5122
cdt2023.ddns.net:8001
cdt2023.ddns.net:9000
cdt2023.ddns.net:9999
cdt2023.ddns.net:8888

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
DesbravadorUpdata.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68600a644c03d75b94c44df3bc908e49974bd01f514aa18bdec7c5c332132302.exe

File Explorer

68600a644c03d75b94c44df3bc908e49974bd01f514aa18bdec7c5c332132302.exe

.exe 50KB

68600a644c03d75b94c44df3bc908e49974bd01f514aa18bdec7c5c332132302.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 68600a644c03d75b94c44df3bc908e49974bd01f514aa18bdec7c5c332132302
MD5 d111009bf7fd08969f36e3616fcb50b1
SHA1 1ba91424a608a3e60d33302264e54812d78dc00b
SHA512 7f3a66d539e22d779f45144ac09153d70b64e77d3f94f8ff33ccd5c0a356eddd0a49de9defe9bf9579021c3d2f3ddc4c75c8df3ae25d0a97cda0688646fe237e
SSDEEP 768:+8vehoRetRgxhsCaYeb85Dv7Cbz+T28Ps1dX0HvbKvYSX0bUeok0QsVOK6OfwJA3:+8mhietREQJa28PsybVfbU9hVu9t9Mx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

68600a644c03d75b94c44df3bc908e49974bd01f514aa18bdec7c5c332132302.exe

mscoree

dotnet