asyncrat | f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f

Sharing

Copy URL Twitter E-mail

General

Target
f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f
Size 45KB
Sample260701-s6ffaahv9m
SHA256 f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f
MD5 4f593cf205d68da0f94afb4e85350705
SHA1 ef0a5422b91fa79f1c3e7f04ef9d09d291f7b4db
SHA512 5b9fea8d2d3db11b09c4b6848c3d3b339dbd2babf73a488bf14c878b7032c0fd02c4c004a98d67fcfccf24174da9933b9f5ceb4ee844c8042d34ef9aa40721ff
SSDEEP 768:gu61pTscmXLdWUpCSbmo2qrQBz3QKx7PIQJjbSgX3izRSOW0LzOTLUBDZNx:gu61pTsHXB2DV0QpbVXSlWVadNx
TLSH
T12C232B003BE8813BF2BE4FB899F26105857AF6633603D6496CC452D75623FC6DA426F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
gootloader.prettylittleplumbs.com:80
gootloader.prettylittleplumbs.com:22
gootloader.prettylittleplumbs.com:8080
gootloader.prettylittleplumbs.com:8880
gootloader.prettylittleplumbs.com:2052
gootloader.prettylittleplumbs.com:2082
gootloader.prettylittleplumbs.com:2086
gootloader.prettylittleplumbs.com:2095
gootloader.prettylittleplumbs.com:443
gootloader.prettylittleplumbs.com:2053
gootloader.prettylittleplumbs.com:2083
gootloader.prettylittleplumbs.com:2087
gootloader.prettylittleplumbs.com:2096
gootloader.prettylittleplumbs.com:8443
downadup.prettylittleplumbs.com:80
downadup.prettylittleplumbs.com:22
downadup.prettylittleplumbs.com:8080
downadup.prettylittleplumbs.com:8880
downadup.prettylittleplumbs.com:2052
downadup.prettylittleplumbs.com:2082
downadup.prettylittleplumbs.com:2086
downadup.prettylittleplumbs.com:2095
downadup.prettylittleplumbs.com:443
downadup.prettylittleplumbs.com:2053
downadup.prettylittleplumbs.com:2083
downadup.prettylittleplumbs.com:2087
downadup.prettylittleplumbs.com:2096
downadup.prettylittleplumbs.com:8443
gozi.prettylittleplumbs.com:80
gozi.prettylittleplumbs.com:22
gozi.prettylittleplumbs.com:8080
gozi.prettylittleplumbs.com:8880
gozi.prettylittleplumbs.com:2052
gozi.prettylittleplumbs.com:2082
gozi.prettylittleplumbs.com:2086
gozi.prettylittleplumbs.com:2095
gozi.prettylittleplumbs.com:443
gozi.prettylittleplumbs.com:2053
gozi.prettylittleplumbs.com:2083
gozi.prettylittleplumbs.com:2087
gozi.prettylittleplumbs.com:2096
gozi.prettylittleplumbs.com:8443
triton.prettylittleplumbs.com:80
triton.prettylittleplumbs.com:22
triton.prettylittleplumbs.com:8080
triton.prettylittleplumbs.com:8880
triton.prettylittleplumbs.com:2052
triton.prettylittleplumbs.com:2082
triton.prettylittleplumbs.com:2086
triton.prettylittleplumbs.com:2095
triton.prettylittleplumbs.com:443
triton.prettylittleplumbs.com:2053
triton.prettylittleplumbs.com:2083
triton.prettylittleplumbs.com:2087
triton.prettylittleplumbs.com:2096
triton.prettylittleplumbs.com:8443

Mutex

Wqc2wYuvGEUE

Attributes

delay
0
install
true
install_file
fe4t427b.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f

File Explorer

f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f

.exe 45KB

f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f
MD5 4f593cf205d68da0f94afb4e85350705
SHA1 ef0a5422b91fa79f1c3e7f04ef9d09d291f7b4db
SHA512 5b9fea8d2d3db11b09c4b6848c3d3b339dbd2babf73a488bf14c878b7032c0fd02c4c004a98d67fcfccf24174da9933b9f5ceb4ee844c8042d34ef9aa40721ff
SSDEEP 768:gu61pTscmXLdWUpCSbmo2qrQBz3QKx7PIQJjbSgX3izRSOW0LzOTLUBDZNx:gu61pTsHXB2DV0QpbVXSlWVadNx
TLSH
T12C232B003BE8813BF2BE4FB899F26105857AF6633603D6496CC452D75623FC6DA426F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f

mscoree

dotnet