asyncrat | 297b13f89414a1bbe8fb2533a8efb46a7d69b1dd9114591a2377b574e1b86066

Sharing

Copy URL Twitter E-mail

General

Target
297b13f89414a1bbe8fb2533a8efb46a7d69b1dd9114591a2377b574e1b86066
Size 45KB
Sample260710-d81rnsdz41
SHA256 297b13f89414a1bbe8fb2533a8efb46a7d69b1dd9114591a2377b574e1b86066
MD5 a7a20b1bf88892fcaf97748d35e412ce
SHA1 bc54a4a5c340eeb44e0f92f2864d3662a2b83935
SHA512 d22c7dccfe368e4cafd86ce9c0a2c7fc70d2b1eaa3e1bf1d5aaebdee588f86a6dd51ca6927b07fa97b54ce93bb025525d1386c524ccfbd1ad077b4dce59569a0
SSDEEP 768:IuuZ5TbUo/BWUlf+DHmo2q7W9+U6NbtOPIMbzjb5gX3zSeivtmw0/CFDBDZFx:IuuZ5Tbjst279UZ3Mb3bWXDtiVmwXdFx
TLSH
T1CF232B003BE9C12BF2BE4F7899F26145867AF6633603D54A1CC4419B5713FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

getinspiredbycathy.com:80
getinspiredbycathy.com:22
getinspiredbycathy.com:8080
getinspiredbycathy.com:8880
getinspiredbycathy.com:2052
getinspiredbycathy.com:2082
getinspiredbycathy.com:2086
getinspiredbycathy.com:2095
getinspiredbycathy.com:443
getinspiredbycathy.com:2053
getinspiredbycathy.com:2083
getinspiredbycathy.com:2087
getinspiredbycathy.com:2096
getinspiredbycathy.com:8443
www.getinspiredbycathy.com:80
www.getinspiredbycathy.com:22
www.getinspiredbycathy.com:8080
www.getinspiredbycathy.com:8880
www.getinspiredbycathy.com:2052
www.getinspiredbycathy.com:2082
www.getinspiredbycathy.com:2086
www.getinspiredbycathy.com:2095
www.getinspiredbycathy.com:443
www.getinspiredbycathy.com:2053
www.getinspiredbycathy.com:2083
www.getinspiredbycathy.com:2087
www.getinspiredbycathy.com:2096
www.getinspiredbycathy.com:8443
qbot.getinspiredbycathy.com:80
qbot.getinspiredbycathy.com:22
qbot.getinspiredbycathy.com:8080
qbot.getinspiredbycathy.com:8880
qbot.getinspiredbycathy.com:2052
qbot.getinspiredbycathy.com:2082
qbot.getinspiredbycathy.com:2086
qbot.getinspiredbycathy.com:2095
qbot.getinspiredbycathy.com:443
qbot.getinspiredbycathy.com:2053
qbot.getinspiredbycathy.com:2083
qbot.getinspiredbycathy.com:2087
qbot.getinspiredbycathy.com:2096
qbot.getinspiredbycathy.com:8443
malware.getinspiredbycathy.com:80
malware.getinspiredbycathy.com:22
malware.getinspiredbycathy.com:8080
malware.getinspiredbycathy.com:8880
malware.getinspiredbycathy.com:2052
malware.getinspiredbycathy.com:2082
malware.getinspiredbycathy.com:2086
malware.getinspiredbycathy.com:2095
malware.getinspiredbycathy.com:443
malware.getinspiredbycathy.com:2053
malware.getinspiredbycathy.com:2083
malware.getinspiredbycathy.com:2087
malware.getinspiredbycathy.com:2096
malware.getinspiredbycathy.com:8443
industroyer.getinspiredbycathy.com:80
industroyer.getinspiredbycathy.com:22
industroyer.getinspiredbycathy.com:8080
industroyer.getinspiredbycathy.com:8880
industroyer.getinspiredbycathy.com:2052
industroyer.getinspiredbycathy.com:2082
industroyer.getinspiredbycathy.com:2086
industroyer.getinspiredbycathy.com:2095
industroyer.getinspiredbycathy.com:443
industroyer.getinspiredbycathy.com:2053
industroyer.getinspiredbycathy.com:2083
industroyer.getinspiredbycathy.com:2087
industroyer.getinspiredbycathy.com:2096
industroyer.getinspiredbycathy.com:8443
wannacry.getinspiredbycathy.com:80
wannacry.getinspiredbycathy.com:22
wannacry.getinspiredbycathy.com:8080
wannacry.getinspiredbycathy.com:8880
wannacry.getinspiredbycathy.com:2052
wannacry.getinspiredbycathy.com:2082
wannacry.getinspiredbycathy.com:2086
wannacry.getinspiredbycathy.com:2095
wannacry.getinspiredbycathy.com:443
wannacry.getinspiredbycathy.com:2053
wannacry.getinspiredbycathy.com:2083
wannacry.getinspiredbycathy.com:2087
wannacry.getinspiredbycathy.com:2096
wannacry.getinspiredbycathy.com:8443

Mutex

MUlwWPnmrBEQ

Attributes

delay
0
install
true
install_file
nivbks.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
297b13f89414a1bbe8fb2533a8efb46a7d69b1dd9114591a2377b574e1b86066

File Explorer

297b13f89414a1bbe8fb2533a8efb46a7d69b1dd9114591a2377b574e1b86066

.exe 45KB

297b13f89414a1bbe8fb2533a8efb46a7d69b1dd9114591a2377b574e1b86066

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 297b13f89414a1bbe8fb2533a8efb46a7d69b1dd9114591a2377b574e1b86066
MD5 a7a20b1bf88892fcaf97748d35e412ce
SHA1 bc54a4a5c340eeb44e0f92f2864d3662a2b83935
SHA512 d22c7dccfe368e4cafd86ce9c0a2c7fc70d2b1eaa3e1bf1d5aaebdee588f86a6dd51ca6927b07fa97b54ce93bb025525d1386c524ccfbd1ad077b4dce59569a0
SSDEEP 768:IuuZ5TbUo/BWUlf+DHmo2q7W9+U6NbtOPIMbzjb5gX3zSeivtmw0/CFDBDZFx:IuuZ5Tbjst279UZ3Mb3bWXDtiVmwXdFx
TLSH
T1CF232B003BE9C12BF2BE4F7899F26145867AF6633603D54A1CC4419B5713FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

297b13f89414a1bbe8fb2533a8efb46a7d69b1dd9114591a2377b574e1b86066

mscoree

dotnet