asyncrat | f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf

Sharing

Copy URL Twitter E-mail

General

Target
f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf
Size 45KB
Sample260706-gdtawsd16n
SHA256 f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf
MD5 69c72b36a3b5a811fe9655141cff9f4e
SHA1 84850b4100da6a3e1c61d7ab4759d7d8524b3620
SHA512 079bdf03ae22d7383db7adeb918b9dff18c08bc7a5582ae9245ef1c5a92bf1f5c8a78e9142f87175baa70b588cfae1daf69cc237d1b2b15536b19bd090d337de
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIszjbGgX3iO1hpuR7F5H2ClW6BDZsx:EulCJTHl42MRvs3bZXSO1hpiDHHDdsx
TLSH
T138231A003BE8C12BF2BE5B78A8F26145867AF6677603D59D1CC4419B5713FC28A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexgaga.com:80
sexgaga.com:22
sexgaga.com:8080
sexgaga.com:8880
sexgaga.com:2052
sexgaga.com:2082
sexgaga.com:2086
sexgaga.com:2095
sexgaga.com:443
sexgaga.com:2053
sexgaga.com:2083
sexgaga.com:2087
sexgaga.com:2096
sexgaga.com:8443
www.sexgaga.com:80
www.sexgaga.com:22
www.sexgaga.com:8080
www.sexgaga.com:8880
www.sexgaga.com:2052
www.sexgaga.com:2082
www.sexgaga.com:2086
www.sexgaga.com:2095
www.sexgaga.com:443
www.sexgaga.com:2053
www.sexgaga.com:2083
www.sexgaga.com:2087
www.sexgaga.com:2096
www.sexgaga.com:8443
hermeticwiper.sexgaga.com:80
hermeticwiper.sexgaga.com:22
hermeticwiper.sexgaga.com:8080
hermeticwiper.sexgaga.com:8880
hermeticwiper.sexgaga.com:2052
hermeticwiper.sexgaga.com:2082
hermeticwiper.sexgaga.com:2086
hermeticwiper.sexgaga.com:2095
hermeticwiper.sexgaga.com:443
hermeticwiper.sexgaga.com:2053
hermeticwiper.sexgaga.com:2083
hermeticwiper.sexgaga.com:2087
hermeticwiper.sexgaga.com:2096
hermeticwiper.sexgaga.com:8443
notpetya.sexgaga.com:80
notpetya.sexgaga.com:22
notpetya.sexgaga.com:8080
notpetya.sexgaga.com:8880
notpetya.sexgaga.com:2052
notpetya.sexgaga.com:2082
notpetya.sexgaga.com:2086
notpetya.sexgaga.com:2095
notpetya.sexgaga.com:443
notpetya.sexgaga.com:2053
notpetya.sexgaga.com:2083
notpetya.sexgaga.com:2087
notpetya.sexgaga.com:2096
notpetya.sexgaga.com:8443
ursnif.sexgaga.com:80
ursnif.sexgaga.com:22
ursnif.sexgaga.com:8080
ursnif.sexgaga.com:8880
ursnif.sexgaga.com:2052
ursnif.sexgaga.com:2082
ursnif.sexgaga.com:2086
ursnif.sexgaga.com:2095
ursnif.sexgaga.com:443
ursnif.sexgaga.com:2053
ursnif.sexgaga.com:2083
ursnif.sexgaga.com:2087
ursnif.sexgaga.com:2096
ursnif.sexgaga.com:8443
klez.sexgaga.com:80
klez.sexgaga.com:22
klez.sexgaga.com:8080
klez.sexgaga.com:8880
klez.sexgaga.com:2052
klez.sexgaga.com:2082
klez.sexgaga.com:2086
klez.sexgaga.com:2095
klez.sexgaga.com:443
klez.sexgaga.com:2053
klez.sexgaga.com:2083
klez.sexgaga.com:2087
klez.sexgaga.com:2096
klez.sexgaga.com:8443

Mutex

KHFpySrgvyYF

Attributes

delay
0
install
true
install_file
5006m4.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf

File Explorer

f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf

.exe 45KB

f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf
MD5 69c72b36a3b5a811fe9655141cff9f4e
SHA1 84850b4100da6a3e1c61d7ab4759d7d8524b3620
SHA512 079bdf03ae22d7383db7adeb918b9dff18c08bc7a5582ae9245ef1c5a92bf1f5c8a78e9142f87175baa70b588cfae1daf69cc237d1b2b15536b19bd090d337de
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIszjbGgX3iO1hpuR7F5H2ClW6BDZsx:EulCJTHl42MRvs3bZXSO1hpiDHHDdsx
TLSH
T138231A003BE8C12BF2BE5B78A8F26145867AF6677603D59D1CC4419B5713FC28A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f19f3f8925209ca2c7c0d1a670230c986651e033dca00e4f3b098e18e5a847bf

mscoree

dotnet