asyncrat | 895aa78047b4c233590e8d0fc4802c3fa9833974895520b5e9e809de68438bd6

Sharing

Copy URL Twitter E-mail

General

Target
895aa78047b4c233590e8d0fc4802c3fa9833974895520b5e9e809de68438bd6
Size 45KB
Sample260712-da1n1set8v
SHA256 895aa78047b4c233590e8d0fc4802c3fa9833974895520b5e9e809de68438bd6
MD5 603123e42d91d185f088cc87a7184d99
SHA1 1667cc2a7db45966ad29dee23ec5687c9a793577
SHA512 783e3444d63053b746f4ad318fedd1325ae255177ca10230d5b0f2a43af635f790a5e7125f9db5ec3879fee5c98378faf1b10f86f6585d5859f48cc92c667832
SSDEEP 768:7uCIJTQc5fVWUhxlDmo2qrHmaPcl83APITpzjbfgX3idu4p32BzyxLBDZkx:7uCIJTQmX24fcS3lTp3boXSdu4pmlyDk
TLSH
T149231A003BE9813BF2BF5F7899F26105467AF2636603D6491CC452DB5723FC68A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mephimsexviet.com:80
mephimsexviet.com:22
mephimsexviet.com:8080
mephimsexviet.com:8880
mephimsexviet.com:2052
mephimsexviet.com:2082
mephimsexviet.com:2086
mephimsexviet.com:2095
mephimsexviet.com:443
mephimsexviet.com:2053
mephimsexviet.com:2083
mephimsexviet.com:2087
mephimsexviet.com:2096
mephimsexviet.com:8443
www.mephimsexviet.com:80
www.mephimsexviet.com:22
www.mephimsexviet.com:8080
www.mephimsexviet.com:8880
www.mephimsexviet.com:2052
www.mephimsexviet.com:2082
www.mephimsexviet.com:2086
www.mephimsexviet.com:2095
www.mephimsexviet.com:443
www.mephimsexviet.com:2053
www.mephimsexviet.com:2083
www.mephimsexviet.com:2087
www.mephimsexviet.com:2096
www.mephimsexviet.com:8443
notpetya.mephimsexviet.com:80
notpetya.mephimsexviet.com:22
notpetya.mephimsexviet.com:8080
notpetya.mephimsexviet.com:8880
notpetya.mephimsexviet.com:2052
notpetya.mephimsexviet.com:2082
notpetya.mephimsexviet.com:2086
notpetya.mephimsexviet.com:2095
notpetya.mephimsexviet.com:443
notpetya.mephimsexviet.com:2053
notpetya.mephimsexviet.com:2083
notpetya.mephimsexviet.com:2087
notpetya.mephimsexviet.com:2096
notpetya.mephimsexviet.com:8443
socgholish.mephimsexviet.com:80
socgholish.mephimsexviet.com:22
socgholish.mephimsexviet.com:8080
socgholish.mephimsexviet.com:8880
socgholish.mephimsexviet.com:2052
socgholish.mephimsexviet.com:2082
socgholish.mephimsexviet.com:2086
socgholish.mephimsexviet.com:2095
socgholish.mephimsexviet.com:443
socgholish.mephimsexviet.com:2053
socgholish.mephimsexviet.com:2083
socgholish.mephimsexviet.com:2087
socgholish.mephimsexviet.com:2096
socgholish.mephimsexviet.com:8443
trisis.mephimsexviet.com:80
trisis.mephimsexviet.com:22
trisis.mephimsexviet.com:8080
trisis.mephimsexviet.com:8880
trisis.mephimsexviet.com:2052
trisis.mephimsexviet.com:2082
trisis.mephimsexviet.com:2086
trisis.mephimsexviet.com:2095
trisis.mephimsexviet.com:443
trisis.mephimsexviet.com:2053
trisis.mephimsexviet.com:2083
trisis.mephimsexviet.com:2087
trisis.mephimsexviet.com:2096
trisis.mephimsexviet.com:8443
codered.mephimsexviet.com:80
codered.mephimsexviet.com:22
codered.mephimsexviet.com:8080
codered.mephimsexviet.com:8880
codered.mephimsexviet.com:2052
codered.mephimsexviet.com:2082
codered.mephimsexviet.com:2086
codered.mephimsexviet.com:2095
codered.mephimsexviet.com:443
codered.mephimsexviet.com:2053
codered.mephimsexviet.com:2083
codered.mephimsexviet.com:2087
codered.mephimsexviet.com:2096
codered.mephimsexviet.com:8443

Mutex

JbaB0CzWv8mc

Attributes

delay
0
install
true
install_file
aixu2gdu.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
895aa78047b4c233590e8d0fc4802c3fa9833974895520b5e9e809de68438bd6

File Explorer

895aa78047b4c233590e8d0fc4802c3fa9833974895520b5e9e809de68438bd6

.exe 45KB

895aa78047b4c233590e8d0fc4802c3fa9833974895520b5e9e809de68438bd6

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 895aa78047b4c233590e8d0fc4802c3fa9833974895520b5e9e809de68438bd6
MD5 603123e42d91d185f088cc87a7184d99
SHA1 1667cc2a7db45966ad29dee23ec5687c9a793577
SHA512 783e3444d63053b746f4ad318fedd1325ae255177ca10230d5b0f2a43af635f790a5e7125f9db5ec3879fee5c98378faf1b10f86f6585d5859f48cc92c667832
SSDEEP 768:7uCIJTQc5fVWUhxlDmo2qrHmaPcl83APITpzjbfgX3idu4p32BzyxLBDZkx:7uCIJTQmX24fcS3lTp3boXSdu4pmlyDk
TLSH
T149231A003BE9813BF2BF5F7899F26105467AF2636603D6491CC452DB5723FC68A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

895aa78047b4c233590e8d0fc4802c3fa9833974895520b5e9e809de68438bd6

mscoree

dotnet