asyncrat | _6e273c64fbbebc57c01ebda37bf16a0288e3146347df963f478f994fce78706a[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
_6e273c64fbbebc57c01ebda37bf16a0288e3146347df963f478f994fce78706a.exe
Size 64KB
Sample260107-ss3nnaax5d
SHA256 6e273c64fbbebc57c01ebda37bf16a0288e3146347df963f478f994fce78706a
MD5 cd9b5f93c8acbccdd85cd1150b5b8b61
SHA1 d44e5df91651d42488d467ba9c62ca0c67f73175
SHA512 4b6b1be7e9f7d11d58497d0b53b0d08099dc95143c507c9409d66d800b75d6e7abb13852d845eb6d2ec71017059830c8110e526692027e7e75a5f267c6b75096
SSDEEP 768:zgsrOQmaiPGOKiV9JRq1PFyxswgrm0b1+eSCv7mqb2n4pfH1ox5/L0Z8GpAkIVcD:z5mVbid4uvcGbbJfEQWG9IVclN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

www.hkw.br.com:8848
www.hkw.br.com:443
www.hkw.br.com:80
www.hkw.br.com:8080
www.hkw.br.com:6060
www.hkw.br.com:4782
www.hkw.br.com:4444
www.hkw.br.com:6666
www.hkw.br.com:5555
hkw.br.com:8848
hkw.br.com:443
hkw.br.com:80
hkw.br.com:8080
hkw.br.com:6060
hkw.br.com:4782
hkw.br.com:4444
hkw.br.com:6666
hkw.br.com:5555
hillstore.uk.com:8848
hillstore.uk.com:443
hillstore.uk.com:80
hillstore.uk.com:8080
hillstore.uk.com:6060
hillstore.uk.com:4782
hillstore.uk.com:4444
hillstore.uk.com:6666
hillstore.uk.com:5555
www.hillstore.uk.com:8848
www.hillstore.uk.com:443
www.hillstore.uk.com:80
www.hillstore.uk.com:8080
www.hillstore.uk.com:6060
www.hillstore.uk.com:4782
www.hillstore.uk.com:4444
www.hillstore.uk.com:6666
www.hillstore.uk.com:5555
aloe.uk.com:8848
aloe.uk.com:443
aloe.uk.com:80
aloe.uk.com:8080
aloe.uk.com:6060
aloe.uk.com:4782
aloe.uk.com:4444
aloe.uk.com:6666
aloe.uk.com:5555
www.aloe.uk.com:8848
www.aloe.uk.com:443
www.aloe.uk.com:80
www.aloe.uk.com:8080
www.aloe.uk.com:6060
www.aloe.uk.com:4782
www.aloe.uk.com:4444
www.aloe.uk.com:6666
www.aloe.uk.com:5555
www.lens-flare.uk.com:8848
www.lens-flare.uk.com:443
www.lens-flare.uk.com:80
www.lens-flare.uk.com:8080
www.lens-flare.uk.com:6060
www.lens-flare.uk.com:4782
www.lens-flare.uk.com:4444
www.lens-flare.uk.com:6666
www.lens-flare.uk.com:5555
lens-flare.uk.com:8848
lens-flare.uk.com:443
lens-flare.uk.com:80
lens-flare.uk.com:8080
lens-flare.uk.com:6060
lens-flare.uk.com:4782
lens-flare.uk.com:4444
lens-flare.uk.com:6666
lens-flare.uk.com:5555
hokigame.org:8848
hokigame.org:443
hokigame.org:80
hokigame.org:8080
hokigame.org:6060
hokigame.org:4782
hokigame.org:4444
hokigame.org:6666
hokigame.org:5555
www.hokigame.org:8848
www.hokigame.org:443
www.hokigame.org:80
www.hokigame.org:8080
www.hokigame.org:6060
www.hokigame.org:4782
www.hokigame.org:4444
www.hokigame.org:6666
www.hokigame.org:5555

Mutex

NSCA_CitadelNetwork_NexusLock_4h5j6k7l

Attributes

delay
1
install
true
install_file
NexusNetworkCitadel.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_6e273c64fbbebc57c01ebda37bf16a0288e3146347df963f478f994fce78706a.exe

File Explorer

_6e273c64fbbebc57c01ebda37bf16a0288e3146347df963f478f994fce78706a.exe

.exe 64KB

_6e273c64fbbebc57c01ebda37bf16a0288e3146347df963f478f994fce78706a.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6e273c64fbbebc57c01ebda37bf16a0288e3146347df963f478f994fce78706a
MD5 cd9b5f93c8acbccdd85cd1150b5b8b61
SHA1 d44e5df91651d42488d467ba9c62ca0c67f73175
SHA512 4b6b1be7e9f7d11d58497d0b53b0d08099dc95143c507c9409d66d800b75d6e7abb13852d845eb6d2ec71017059830c8110e526692027e7e75a5f267c6b75096
SSDEEP 768:zgsrOQmaiPGOKiV9JRq1PFyxswgrm0b1+eSCv7mqb2n4pfH1ox5/L0Z8GpAkIVcD:z5mVbid4uvcGbbJfEQWG9IVclN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB paths

_6e273c64fbbebc57c01ebda37bf16a0288e3146347df963f478f994fce78706a.exe

mscoree

dotnet