asyncrat | NACMAYNE[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NACMAYNE.exe
Size 48KB
Sample260709-t1eggaev3x
SHA256 0503991b46f7ebb4c846633be5d9397ab4c10a81e5373115bc45a03ff2ad0981
MD5 212705784be2cfc6002138214e1ed4e5
SHA1 287c3bea3f96b3624723084ee570a60ca67142c1
SHA512 b02cb5ec43440779ea7616e1494822aac231aa8b1ef2c12d9f8fc8b72997f5950d48e2ac1aed7fabdaf32235cb7194650b64e52fd0d6978294fa23d44e2a1578
SSDEEP 768:FuSyipTpwrSWWUE3/WImo2qNtIn4jIIJIPIkcZfBgZc90bTK9HcL7t/exDjTBDZR:FuSyipTpoo2CdjBnkcZpgZbbTsHcL7cR
TLSH
T1A0234C043BEA812BF2BE4FB49DF26145457AE5633607D60E2CC401DB5713FC69A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat phantom rat asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

PHANTOM RAT

npgdistribuciones.com.co:8443
npgdistribuciones.com.co:81
npgdistribuciones.com.co:7878
npgdistribuciones.com.co:8787
npgdistribuciones.com.co:6789
npgdistribuciones.com.co:80
npgdistribuciones.com.co:8080
npgdistribuciones.com.co:443
dbsazara.in:8443
dbsazara.in:81
dbsazara.in:7878
dbsazara.in:8787
dbsazara.in:6789
dbsazara.in:80
dbsazara.in:8080
dbsazara.in:443
crepprotect.com.co:8443
crepprotect.com.co:81
crepprotect.com.co:7878
crepprotect.com.co:8787
crepprotect.com.co:6789
crepprotect.com.co:80
crepprotect.com.co:8080
crepprotect.com.co:443
salmaans.in:8443
salmaans.in:81
salmaans.in:7878
salmaans.in:8787
salmaans.in:6789
salmaans.in:80
salmaans.in:8080
salmaans.in:443
duplexplay.me:8443
duplexplay.me:81
duplexplay.me:7878
duplexplay.me:8787
duplexplay.me:6789
duplexplay.me:80
duplexplay.me:8080
duplexplay.me:443
emmanews.mx:8443
emmanews.mx:81
emmanews.mx:7878
emmanews.mx:8787
emmanews.mx:6789
emmanews.mx:80
emmanews.mx:8080
emmanews.mx:443
visitiz.travel:8443
visitiz.travel:81
visitiz.travel:7878
visitiz.travel:8787
visitiz.travel:6789
visitiz.travel:80
visitiz.travel:8080
visitiz.travel:443

Mutex

wHNuMOc7RsMv

Attributes

delay
3
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NACMAYNE.exe

File Explorer

NACMAYNE.exe

.exe 48KB

NACMAYNE.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0503991b46f7ebb4c846633be5d9397ab4c10a81e5373115bc45a03ff2ad0981
MD5 212705784be2cfc6002138214e1ed4e5
SHA1 287c3bea3f96b3624723084ee570a60ca67142c1
SHA512 b02cb5ec43440779ea7616e1494822aac231aa8b1ef2c12d9f8fc8b72997f5950d48e2ac1aed7fabdaf32235cb7194650b64e52fd0d6978294fa23d44e2a1578
SSDEEP 768:FuSyipTpwrSWWUE3/WImo2qNtIn4jIIJIPIkcZfBgZc90bTK9HcL7t/exDjTBDZR:FuSyipTpoo2CdjBnkcZpgZbbTsHcL7cR
TLSH
T1A0234C043BEA812BF2BE4FB49DF26145457AE5633607D60E2CC401DB5713FC69A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

NACMAYNE.exe

mscoree

dotnet