asyncrat | vertexedge[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
vertexedge.exe
Size 64KB
Sample260111-s8ddpshy9a
SHA256 5373ab86ceeab08fabe076737f4dfc00362048c6bbf329604bdfbe97497a4fab
MD5 396e2739a2375723afeaa8b6172121ac
SHA1 147ef0bd21d5332b98a31e00f9e652f4780dd0e5
SHA512 d68095a1a2821773a6a514c60490d6075e11766066234cce85a43cd8966e4ef92192a6639318e47da1f576e735c649e91dba818b3631a2ded3ee78a57e7e120f
SSDEEP 768:qWdwIms4SiPsbRiH9J8ID3l9R29pnXwQ1+ASCvAmqb2nIFpwH1ox82DGz8G1DVcD:q64BdLV9k/XwQGnbbPwoQQG1DVclN
TLSH
T152536B002798CA66E1AE4AB4ACF2560046B5D5772102DB5E7CC814CB6B9FFC646237FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat vertex asyncrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Vertex

alloparentsbebe.org:6666
alloparentsbebe.org:8080
alloparentsbebe.org:80
alloparentsbebe.org:443
alloparentsbebe.org:5555
alloparentsbebe.org:1604
alloparentsbebe.org:4444
alloparentsbebe.org:6606
alloparentsbebe.org:8443
www.alloparentsbebe.org:6666
www.alloparentsbebe.org:8080
www.alloparentsbebe.org:80
www.alloparentsbebe.org:443
www.alloparentsbebe.org:5555
www.alloparentsbebe.org:1604
www.alloparentsbebe.org:4444
www.alloparentsbebe.org:6606
www.alloparentsbebe.org:8443
okvip168th.net:6666
okvip168th.net:8080
okvip168th.net:80
okvip168th.net:443
okvip168th.net:5555
okvip168th.net:1604
okvip168th.net:4444
okvip168th.net:6606
okvip168th.net:8443
www.okvip168th.net:6666
www.okvip168th.net:8080
www.okvip168th.net:80
www.okvip168th.net:443
www.okvip168th.net:5555
www.okvip168th.net:1604
www.okvip168th.net:4444
www.okvip168th.net:6606
www.okvip168th.net:8443
xacmgm.za.com:6666
xacmgm.za.com:8080
xacmgm.za.com:80
xacmgm.za.com:443
xacmgm.za.com:5555
xacmgm.za.com:1604
xacmgm.za.com:4444
xacmgm.za.com:6606
xacmgm.za.com:8443
www.xacmgm.za.com:6666
www.xacmgm.za.com:8080
www.xacmgm.za.com:80
www.xacmgm.za.com:443
www.xacmgm.za.com:5555
www.xacmgm.za.com:1604
www.xacmgm.za.com:4444
www.xacmgm.za.com:6606
www.xacmgm.za.com:8443
www.open88top1.com:6666
www.open88top1.com:8080
www.open88top1.com:80
www.open88top1.com:443
www.open88top1.com:5555
www.open88top1.com:1604
www.open88top1.com:4444
www.open88top1.com:6606
www.open88top1.com:8443
www.789bet-trangchu.vip:6666
www.789bet-trangchu.vip:8080
www.789bet-trangchu.vip:80
www.789bet-trangchu.vip:443
www.789bet-trangchu.vip:5555
www.789bet-trangchu.vip:1604
www.789bet-trangchu.vip:4444
www.789bet-trangchu.vip:6606
www.789bet-trangchu.vip:8443
789bet-trangchu.vip:6666
789bet-trangchu.vip:8080
789bet-trangchu.vip:80
789bet-trangchu.vip:443
789bet-trangchu.vip:5555
789bet-trangchu.vip:1604
789bet-trangchu.vip:4444
789bet-trangchu.vip:6606
789bet-trangchu.vip:8443
open88top1.com:6666
open88top1.com:8080
open88top1.com:80
open88top1.com:443
open88top1.com:5555
open88top1.com:1604
open88top1.com:4444
open88top1.com:6606
open88top1.com:8443

Mutex

Download

Attributes

delay
1
install
true
install_file
vertexedge.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vertexedge.exe

File Explorer

vertexedge.exe

.exe 64KB

vertexedge.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5373ab86ceeab08fabe076737f4dfc00362048c6bbf329604bdfbe97497a4fab
MD5 396e2739a2375723afeaa8b6172121ac
SHA1 147ef0bd21d5332b98a31e00f9e652f4780dd0e5
SHA512 d68095a1a2821773a6a514c60490d6075e11766066234cce85a43cd8966e4ef92192a6639318e47da1f576e735c649e91dba818b3631a2ded3ee78a57e7e120f
SSDEEP 768:qWdwIms4SiPsbRiH9J8ID3l9R29pnXwQ1+ASCvAmqb2nIFpwH1ox82DGz8G1DVcD:q64BdLV9k/XwQGnbbPwoQQG1DVclN
TLSH
T152536B002798CA66E1AE4AB4ACF2560046B5D5772102DB5E7CC814CB6B9FFC646237FF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB paths

vertexedge.exe

mscoree

dotnet