asyncrat | cff24e53b4f97e6530a6dae281fa1f937eecd925700c86fc40386711f8e4766e[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
cff24e53b4f97e6530a6dae281fa1f937eecd925700c86fc40386711f8e4766e.exe
Size 65KB
Sample241103-eghbpavbmn
SHA256 cff24e53b4f97e6530a6dae281fa1f937eecd925700c86fc40386711f8e4766e
MD5 a38eb31e75d43ee14bb1180f51f16af2
SHA1 bd604e905f8ba20bf9397fa55625917ff742863a
SHA512 db613d5ca012979aa4d0b7f62412ff43710cbe1d2c03a185c38e613d3f6b1e74ad3389086ef0144a5fc31b641c5b002c5673dd4d39426e2e3cca1afd39b72b77
SSDEEP 1536:A23fiwQkmEVHKSDpTL+eOss4YuVE8jU6aDk5QJ2h8Hb4nuF/0NgR8rzTRjx:A23fiwQkpE8jU6aEK2hwb4OcNgOLZx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat _cu_asyncrat

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

_CU_

cdt2023.ddns.net:6606
cdt2023.ddns.net:7707
cdt2023.ddns.net:8808
cdt2023.ddns.net:3313
cdt2023.ddns.net:3314
cdt2023.ddns.net:9441
cdt2023.ddns.net:9442
cdt2023.ddns.net:9443
cdt2023.ddns.net:2900
cdt2023.ddns.net:1018
cdt2023.ddns.net:2019
cdt2023.ddns.net:2020
cdt2023.ddns.net:2021
cdt2023.ddns.net:5155
cdt2023.ddns.net:6666
cdt2023.ddns.net:9999
cdt2023.ddns.net:5505
chromedata.accesscam.org:6606
chromedata.accesscam.org:7707
chromedata.accesscam.org:8808
chromedata.accesscam.org:3313
chromedata.accesscam.org:3314
chromedata.accesscam.org:9441
chromedata.accesscam.org:9442
chromedata.accesscam.org:9443
chromedata.accesscam.org:2900
chromedata.accesscam.org:1018
chromedata.accesscam.org:2019
chromedata.accesscam.org:2020
chromedata.accesscam.org:2021
chromedata.accesscam.org:5155
chromedata.accesscam.org:6666
chromedata.accesscam.org:9999
chromedata.accesscam.org:5505
chromedata.webredirect.org:6606
chromedata.webredirect.org:7707
chromedata.webredirect.org:8808
chromedata.webredirect.org:3313
chromedata.webredirect.org:3314
chromedata.webredirect.org:9441
chromedata.webredirect.org:9442
chromedata.webredirect.org:9443
chromedata.webredirect.org:2900
chromedata.webredirect.org:1018
chromedata.webredirect.org:2019
chromedata.webredirect.org:2020
chromedata.webredirect.org:2021
chromedata.webredirect.org:5155
chromedata.webredirect.org:6666
chromedata.webredirect.org:9999
chromedata.webredirect.org:5505
cepas2023.duckdns.org:6606
cepas2023.duckdns.org:7707
cepas2023.duckdns.org:8808
cepas2023.duckdns.org:3313
cepas2023.duckdns.org:3314
cepas2023.duckdns.org:9441
cepas2023.duckdns.org:9442
cepas2023.duckdns.org:9443
cepas2023.duckdns.org:2900
cepas2023.duckdns.org:1018
cepas2023.duckdns.org:2019
cepas2023.duckdns.org:2020
cepas2023.duckdns.org:2021
cepas2023.duckdns.org:5155
cepas2023.duckdns.org:6666
cepas2023.duckdns.org:9999
cepas2023.duckdns.org:5505
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:3313
127.0.0.1:3314
127.0.0.1:9441
127.0.0.1:9442
127.0.0.1:9443
127.0.0.1:2900
127.0.0.1:1018
127.0.0.1:2019
127.0.0.1:2020
127.0.0.1:2021
127.0.0.1:5155
127.0.0.1:6666
127.0.0.1:9999
127.0.0.1:5505
45.40.96.97:6606
45.40.96.97:7707
45.40.96.97:8808
45.40.96.97:3313
45.40.96.97:3314
45.40.96.97:9441
45.40.96.97:9442
45.40.96.97:9443
45.40.96.97:2900
45.40.96.97:1018
45.40.96.97:2019
45.40.96.97:2020
45.40.96.97:2021
45.40.96.97:5155
45.40.96.97:6666
45.40.96.97:9999
45.40.96.97:5505

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cff24e53b4f97e6530a6dae281fa1f937eecd925700c86fc40386711f8e4766e.exe

File Explorer

cff24e53b4f97e6530a6dae281fa1f937eecd925700c86fc40386711f8e4766e.exe

.exe 65KB

cff24e53b4f97e6530a6dae281fa1f937eecd925700c86fc40386711f8e4766e.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 cff24e53b4f97e6530a6dae281fa1f937eecd925700c86fc40386711f8e4766e
MD5 a38eb31e75d43ee14bb1180f51f16af2
SHA1 bd604e905f8ba20bf9397fa55625917ff742863a
SHA512 db613d5ca012979aa4d0b7f62412ff43710cbe1d2c03a185c38e613d3f6b1e74ad3389086ef0144a5fc31b641c5b002c5673dd4d39426e2e3cca1afd39b72b77
SSDEEP 1536:A23fiwQkmEVHKSDpTL+eOss4YuVE8jU6aDk5QJ2h8Hb4nuF/0NgR8rzTRjx:A23fiwQkpE8jU6aEK2hwb4OcNgOLZx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

cff24e53b4f97e6530a6dae281fa1f937eecd925700c86fc40386711f8e4766e.exe

mscoree

dotnet