asyncrat | VSDCVanguardPrime[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
VSDCVanguardPrime.exe
Size 46KB
Sample260111-rs4ehsgx9c
SHA256 513e79e43a92f59544bfbcfd0953aaadb4cf330e94c054afb465de5988feb735
MD5 92528bef32ecca33e1d5b133de0cc851
SHA1 77747226b6f6b3b38b5e1f71d23ddaefd38abaf7
SHA512 acdb09dc514d06795f8e368fb168126a62566430950297036265737f21f30be30f29ab5e7d96de908d6382777800c023f6710dfe12fb7ed66ba7a18cf96e9cbe
SSDEEP 768:3u4dug2JTbXcZz1WUBHCjmo2qrzmFowdWz7h8xPIg2zjbAgX3ijETmc0JHRgOBDY:3u4dug2JTjOK2HoLXz3bnXSgTmNgAdkh
TLSH
T127232B003BEDC12BF2BF5F74A9F26145467AF6672A02D54E1CC4019B1613FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat agcca_primeendpoint asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

AGCCA_PrimeEndpoint

xar.uk.com:6606
xar.uk.com:7707
xar.uk.com:8808
xar.uk.com:443
xar.uk.com:4782
xar.uk.com:8848
xar.uk.com:8080
xar.uk.com:5555
xar.uk.com:6666
xar.uk.com:4444
xar.uk.com:6060
xar.uk.com:80
www.xar.uk.com:6606
www.xar.uk.com:7707
www.xar.uk.com:8808
www.xar.uk.com:443
www.xar.uk.com:4782
www.xar.uk.com:8848
www.xar.uk.com:8080
www.xar.uk.com:5555
www.xar.uk.com:6666
www.xar.uk.com:4444
www.xar.uk.com:6060
www.xar.uk.com:80
crwqin.ru.com:6606
crwqin.ru.com:7707
crwqin.ru.com:8808
crwqin.ru.com:443
crwqin.ru.com:4782
crwqin.ru.com:8848
crwqin.ru.com:8080
crwqin.ru.com:5555
crwqin.ru.com:6666
crwqin.ru.com:4444
crwqin.ru.com:6060
crwqin.ru.com:80
www.crwqin.ru.com:6606
www.crwqin.ru.com:7707
www.crwqin.ru.com:8808
www.crwqin.ru.com:443
www.crwqin.ru.com:4782
www.crwqin.ru.com:8848
www.crwqin.ru.com:8080
www.crwqin.ru.com:5555
www.crwqin.ru.com:6666
www.crwqin.ru.com:4444
www.crwqin.ru.com:6060
www.crwqin.ru.com:80
www.bacan4d.jp.net:6606
www.bacan4d.jp.net:7707
www.bacan4d.jp.net:8808
www.bacan4d.jp.net:443
www.bacan4d.jp.net:4782
www.bacan4d.jp.net:8848
www.bacan4d.jp.net:8080
www.bacan4d.jp.net:5555
www.bacan4d.jp.net:6666
www.bacan4d.jp.net:4444
www.bacan4d.jp.net:6060
www.bacan4d.jp.net:80
bacan4d.jp.net:6606
bacan4d.jp.net:7707
bacan4d.jp.net:8808
bacan4d.jp.net:443
bacan4d.jp.net:4782
bacan4d.jp.net:8848
bacan4d.jp.net:8080
bacan4d.jp.net:5555
bacan4d.jp.net:6666
bacan4d.jp.net:4444
bacan4d.jp.net:6060
bacan4d.jp.net:80
mdf.uk.com:6606
mdf.uk.com:7707
mdf.uk.com:8808
mdf.uk.com:443
mdf.uk.com:4782
mdf.uk.com:8848
mdf.uk.com:8080
mdf.uk.com:5555
mdf.uk.com:6666
mdf.uk.com:4444
mdf.uk.com:6060
mdf.uk.com:80
www.mdf.uk.com:6606
www.mdf.uk.com:7707
www.mdf.uk.com:8808
www.mdf.uk.com:443
www.mdf.uk.com:4782
www.mdf.uk.com:8848
www.mdf.uk.com:8080
www.mdf.uk.com:5555
www.mdf.uk.com:6666
www.mdf.uk.com:4444
www.mdf.uk.com:6060
www.mdf.uk.com:80

Mutex

VSDC_PrimeSentinel_VanguardLock_7a8b9c0d

Attributes

delay
3
install
true
install_file
VSDC Vanguard Prime Sentinel.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VSDCVanguardPrime.exe

File Explorer

VSDCVanguardPrime.exe

.exe 46KB

VSDCVanguardPrime.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 513e79e43a92f59544bfbcfd0953aaadb4cf330e94c054afb465de5988feb735
MD5 92528bef32ecca33e1d5b133de0cc851
SHA1 77747226b6f6b3b38b5e1f71d23ddaefd38abaf7
SHA512 acdb09dc514d06795f8e368fb168126a62566430950297036265737f21f30be30f29ab5e7d96de908d6382777800c023f6710dfe12fb7ed66ba7a18cf96e9cbe
SSDEEP 768:3u4dug2JTbXcZz1WUBHCjmo2qrzmFowdWz7h8xPIg2zjbAgX3ijETmc0JHRgOBDY:3u4dug2JTjOK2HoLXz3bnXSgTmNgAdkh
TLSH
T127232B003BEDC12BF2BF5F74A9F26145467AF6672A02D54E1CC4019B1613FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

VSDCVanguardPrime.exe

mscoree

dotnet