asyncrat | 3ca8c47764f8b40c90b82e18cb042bfa9e2afb574a40d36154b4f1dd78801df1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
3ca8c47764f8b40c90b82e18cb042bfa9e2afb574a40d36154b4f1dd78801df1.exe
Size 45KB
Sample260710-ra95caax4m
SHA256 3ca8c47764f8b40c90b82e18cb042bfa9e2afb574a40d36154b4f1dd78801df1
MD5 8e03416e4bdcc2d4e7e628653c38291e
SHA1 2884af4bce117ab29fa29fb9447dfdfa6578598a
SHA512 e667619e8f7577df12ca5859cda9be1720e562206ef5c125d46583eee94859438ca2dd3a8a058b9a138a35613f5a97af884f8c54900bf8b3b66cac942c0ecdca
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwvBlte40WMOPI0IzjbxgXSiMQwXcZzakW/2X0WBDZO:ku40ZTXEb2F2UM30I3b+XbMQjNaNG048
TLSH
T1CC232B003BE88127F2BE4F789CF26145867AF5637603DA4A1CC451DB4723BC69A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lophimsexviet.com:80
lophimsexviet.com:22
lophimsexviet.com:8080
lophimsexviet.com:8880
lophimsexviet.com:2052
lophimsexviet.com:2082
lophimsexviet.com:2086
lophimsexviet.com:2095
lophimsexviet.com:443
lophimsexviet.com:2053
lophimsexviet.com:2083
lophimsexviet.com:2087
lophimsexviet.com:2096
lophimsexviet.com:8443
www.lophimsexviet.com:80
www.lophimsexviet.com:22
www.lophimsexviet.com:8080
www.lophimsexviet.com:8880
www.lophimsexviet.com:2052
www.lophimsexviet.com:2082
www.lophimsexviet.com:2086
www.lophimsexviet.com:2095
www.lophimsexviet.com:443
www.lophimsexviet.com:2053
www.lophimsexviet.com:2083
www.lophimsexviet.com:2087
www.lophimsexviet.com:2096
www.lophimsexviet.com:8443
agenttesla.lophimsexviet.com:80
agenttesla.lophimsexviet.com:22
agenttesla.lophimsexviet.com:8080
agenttesla.lophimsexviet.com:8880
agenttesla.lophimsexviet.com:2052
agenttesla.lophimsexviet.com:2082
agenttesla.lophimsexviet.com:2086
agenttesla.lophimsexviet.com:2095
agenttesla.lophimsexviet.com:443
agenttesla.lophimsexviet.com:2053
agenttesla.lophimsexviet.com:2083
agenttesla.lophimsexviet.com:2087
agenttesla.lophimsexviet.com:2096
agenttesla.lophimsexviet.com:8443
codered.lophimsexviet.com:80
codered.lophimsexviet.com:22
codered.lophimsexviet.com:8080
codered.lophimsexviet.com:8880
codered.lophimsexviet.com:2052
codered.lophimsexviet.com:2082
codered.lophimsexviet.com:2086
codered.lophimsexviet.com:2095
codered.lophimsexviet.com:443
codered.lophimsexviet.com:2053
codered.lophimsexviet.com:2083
codered.lophimsexviet.com:2087
codered.lophimsexviet.com:2096
codered.lophimsexviet.com:8443
qbot.lophimsexviet.com:80
qbot.lophimsexviet.com:22
qbot.lophimsexviet.com:8080
qbot.lophimsexviet.com:8880
qbot.lophimsexviet.com:2052
qbot.lophimsexviet.com:2082
qbot.lophimsexviet.com:2086
qbot.lophimsexviet.com:2095
qbot.lophimsexviet.com:443
qbot.lophimsexviet.com:2053
qbot.lophimsexviet.com:2083
qbot.lophimsexviet.com:2087
qbot.lophimsexviet.com:2096
qbot.lophimsexviet.com:8443

Mutex

EW8wgoFGVQJh

Attributes

delay
0
install
true
install_file
3o67p.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ca8c47764f8b40c90b82e18cb042bfa9e2afb574a40d36154b4f1dd78801df1.exe

File Explorer

3ca8c47764f8b40c90b82e18cb042bfa9e2afb574a40d36154b4f1dd78801df1.exe

.exe 45KB

3ca8c47764f8b40c90b82e18cb042bfa9e2afb574a40d36154b4f1dd78801df1.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3ca8c47764f8b40c90b82e18cb042bfa9e2afb574a40d36154b4f1dd78801df1
MD5 8e03416e4bdcc2d4e7e628653c38291e
SHA1 2884af4bce117ab29fa29fb9447dfdfa6578598a
SHA512 e667619e8f7577df12ca5859cda9be1720e562206ef5c125d46583eee94859438ca2dd3a8a058b9a138a35613f5a97af884f8c54900bf8b3b66cac942c0ecdca
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwvBlte40WMOPI0IzjbxgXSiMQwXcZzakW/2X0WBDZO:ku40ZTXEb2F2UM30I3b+XbMQjNaNG048
TLSH
T1CC232B003BE88127F2BE4F789CF26145867AF5637603DA4A1CC451DB4723BC69A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

3ca8c47764f8b40c90b82e18cb042bfa9e2afb574a40d36154b4f1dd78801df1.exe

mscoree

dotnet