asyncrat | dc6b9c92e77a0ec0ba8171a9f5e91809d6465c1f2f2ee0ed4abe4c7be4fcf537

Sharing

Copy URL Twitter E-mail

General

Target
dc6b9c92e77a0ec0ba8171a9f5e91809d6465c1f2f2ee0ed4abe4c7be4fcf537
Size 45KB
Sample260712-v67wmsgv5w
SHA256 dc6b9c92e77a0ec0ba8171a9f5e91809d6465c1f2f2ee0ed4abe4c7be4fcf537
MD5 2fa3af2056f890d361ce43edb9eb1c9e
SHA1 c4aada598c976c2e066874bc6b007761d99ace77
SHA512 9d8cb367747f28d800ac3927da31e8cee26c94f498371a3f6b05550a22ad88bb2553899c68d36b578d7f4391a16967bf5765786aa82309d34b25968a378f7efa
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7J6R8aI3OPIOzjbog93iaJb9rxPCZsbiS/ikT6BD4:0ushJTDXgH2o+FO3O3b/9SqZcZsbi1k7
TLSH
T14D231A0037E8C12BF1BE4F7899F26145867EB6637603D64A1CC451DB5623FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexvietfree.com:80
sexvietfree.com:22
sexvietfree.com:8080
sexvietfree.com:8880
sexvietfree.com:2052
sexvietfree.com:2082
sexvietfree.com:2086
sexvietfree.com:2095
sexvietfree.com:443
sexvietfree.com:2053
sexvietfree.com:2083
sexvietfree.com:2087
sexvietfree.com:2096
sexvietfree.com:8443
www.sexvietfree.com:80
www.sexvietfree.com:22
www.sexvietfree.com:8080
www.sexvietfree.com:8880
www.sexvietfree.com:2052
www.sexvietfree.com:2082
www.sexvietfree.com:2086
www.sexvietfree.com:2095
www.sexvietfree.com:443
www.sexvietfree.com:2053
www.sexvietfree.com:2083
www.sexvietfree.com:2087
www.sexvietfree.com:2096
www.sexvietfree.com:8443
sodinokibi.sexvietfree.com:80
sodinokibi.sexvietfree.com:22
sodinokibi.sexvietfree.com:8080
sodinokibi.sexvietfree.com:8880
sodinokibi.sexvietfree.com:2052
sodinokibi.sexvietfree.com:2082
sodinokibi.sexvietfree.com:2086
sodinokibi.sexvietfree.com:2095
sodinokibi.sexvietfree.com:443
sodinokibi.sexvietfree.com:2053
sodinokibi.sexvietfree.com:2083
sodinokibi.sexvietfree.com:2087
sodinokibi.sexvietfree.com:2096
sodinokibi.sexvietfree.com:8443
cryptolocker.sexvietfree.com:80
cryptolocker.sexvietfree.com:22
cryptolocker.sexvietfree.com:8080
cryptolocker.sexvietfree.com:8880
cryptolocker.sexvietfree.com:2052
cryptolocker.sexvietfree.com:2082
cryptolocker.sexvietfree.com:2086
cryptolocker.sexvietfree.com:2095
cryptolocker.sexvietfree.com:443
cryptolocker.sexvietfree.com:2053
cryptolocker.sexvietfree.com:2083
cryptolocker.sexvietfree.com:2087
cryptolocker.sexvietfree.com:2096
cryptolocker.sexvietfree.com:8443
qbot.sexvietfree.com:80
qbot.sexvietfree.com:22
qbot.sexvietfree.com:8080
qbot.sexvietfree.com:8880
qbot.sexvietfree.com:2052
qbot.sexvietfree.com:2082
qbot.sexvietfree.com:2086
qbot.sexvietfree.com:2095
qbot.sexvietfree.com:443
qbot.sexvietfree.com:2053
qbot.sexvietfree.com:2083
qbot.sexvietfree.com:2087
qbot.sexvietfree.com:2096
qbot.sexvietfree.com:8443
malware.sexvietfree.com:80
malware.sexvietfree.com:22
malware.sexvietfree.com:8080
malware.sexvietfree.com:8880
malware.sexvietfree.com:2052
malware.sexvietfree.com:2082
malware.sexvietfree.com:2086
malware.sexvietfree.com:2095
malware.sexvietfree.com:443
malware.sexvietfree.com:2053
malware.sexvietfree.com:2083
malware.sexvietfree.com:2087
malware.sexvietfree.com:2096
malware.sexvietfree.com:8443

Mutex

8oQxo9iZhhv6

Attributes

delay
0
install
true
install_file
3cev0k.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc6b9c92e77a0ec0ba8171a9f5e91809d6465c1f2f2ee0ed4abe4c7be4fcf537

File Explorer

dc6b9c92e77a0ec0ba8171a9f5e91809d6465c1f2f2ee0ed4abe4c7be4fcf537

.exe 45KB

dc6b9c92e77a0ec0ba8171a9f5e91809d6465c1f2f2ee0ed4abe4c7be4fcf537

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 dc6b9c92e77a0ec0ba8171a9f5e91809d6465c1f2f2ee0ed4abe4c7be4fcf537
MD5 2fa3af2056f890d361ce43edb9eb1c9e
SHA1 c4aada598c976c2e066874bc6b007761d99ace77
SHA512 9d8cb367747f28d800ac3927da31e8cee26c94f498371a3f6b05550a22ad88bb2553899c68d36b578d7f4391a16967bf5765786aa82309d34b25968a378f7efa
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7J6R8aI3OPIOzjbog93iaJb9rxPCZsbiS/ikT6BD4:0ushJTDXgH2o+FO3O3b/9SqZcZsbi1k7
TLSH
T14D231A0037E8C12BF1BE4F7899F26145867EB6637603D64A1CC451DB5623FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

dc6b9c92e77a0ec0ba8171a9f5e91809d6465c1f2f2ee0ed4abe4c7be4fcf537

mscoree

dotnet