asyncrat | 7b609db71ed7505a9b458146de415ad73fc203dc1503bec8640b1a517c8ad6cd

Sharing

Copy URL Twitter E-mail

General

Target
7b609db71ed7505a9b458146de415ad73fc203dc1503bec8640b1a517c8ad6cd
Size 45KB
Sample260715-nc2dfad191
SHA256 7b609db71ed7505a9b458146de415ad73fc203dc1503bec8640b1a517c8ad6cd
MD5 772a2606ca7ba66e9a0851fd968705eb
SHA1 ad523a935fcd50c1ba3ef4392141d7add85154b1
SHA512 89107d47eb661117401aa81cac3ebd5a84fe012a08b0b91d5658776248cc7fe9a73026eb37a1c84c2720da8665d31340c151088e97e94c398ed5b2378bb80c0b
SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qrdcP0pycvHPIjzjbYgX3iyvYMGUmzhZklXBDZ0x:ruKQpTAOX2QccMcvgj3bPXSjImzhZk30
TLSH
T1B6233B0037E8823BF2BF4F789DF26245467AF6632603D5491CC441DB5623BC69A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

lephimsexviet.com:80
lephimsexviet.com:22
lephimsexviet.com:8080
lephimsexviet.com:8880
lephimsexviet.com:2052
lephimsexviet.com:2082
lephimsexviet.com:2086
lephimsexviet.com:2095
lephimsexviet.com:443
lephimsexviet.com:2053
lephimsexviet.com:2083
lephimsexviet.com:2087
lephimsexviet.com:2096
lephimsexviet.com:8443
www.lephimsexviet.com:80
www.lephimsexviet.com:22
www.lephimsexviet.com:8080
www.lephimsexviet.com:8880
www.lephimsexviet.com:2052
www.lephimsexviet.com:2082
www.lephimsexviet.com:2086
www.lephimsexviet.com:2095
www.lephimsexviet.com:443
www.lephimsexviet.com:2053
www.lephimsexviet.com:2083
www.lephimsexviet.com:2087
www.lephimsexviet.com:2096
www.lephimsexviet.com:8443
connect.lephimsexviet.com:80
connect.lephimsexviet.com:22
connect.lephimsexviet.com:8080
connect.lephimsexviet.com:8880
connect.lephimsexviet.com:2052
connect.lephimsexviet.com:2082
connect.lephimsexviet.com:2086
connect.lephimsexviet.com:2095
connect.lephimsexviet.com:443
connect.lephimsexviet.com:2053
connect.lephimsexviet.com:2083
connect.lephimsexviet.com:2087
connect.lephimsexviet.com:2096
connect.lephimsexviet.com:8443
socgholish.lephimsexviet.com:80
socgholish.lephimsexviet.com:22
socgholish.lephimsexviet.com:8080
socgholish.lephimsexviet.com:8880
socgholish.lephimsexviet.com:2052
socgholish.lephimsexviet.com:2082
socgholish.lephimsexviet.com:2086
socgholish.lephimsexviet.com:2095
socgholish.lephimsexviet.com:443
socgholish.lephimsexviet.com:2053
socgholish.lephimsexviet.com:2083
socgholish.lephimsexviet.com:2087
socgholish.lephimsexviet.com:2096
socgholish.lephimsexviet.com:8443
industroyer.lephimsexviet.com:80
industroyer.lephimsexviet.com:22
industroyer.lephimsexviet.com:8080
industroyer.lephimsexviet.com:8880
industroyer.lephimsexviet.com:2052
industroyer.lephimsexviet.com:2082
industroyer.lephimsexviet.com:2086
industroyer.lephimsexviet.com:2095
industroyer.lephimsexviet.com:443
industroyer.lephimsexviet.com:2053
industroyer.lephimsexviet.com:2083
industroyer.lephimsexviet.com:2087
industroyer.lephimsexviet.com:2096
industroyer.lephimsexviet.com:8443
conficker.lephimsexviet.com:80
conficker.lephimsexviet.com:22
conficker.lephimsexviet.com:8080
conficker.lephimsexviet.com:8880
conficker.lephimsexviet.com:2052
conficker.lephimsexviet.com:2082
conficker.lephimsexviet.com:2086
conficker.lephimsexviet.com:2095
conficker.lephimsexviet.com:443
conficker.lephimsexviet.com:2053
conficker.lephimsexviet.com:2083
conficker.lephimsexviet.com:2087
conficker.lephimsexviet.com:2096
conficker.lephimsexviet.com:8443

Mutex

lcfKVtY9ot8t

Attributes

delay
0
install
true
install_file
gvkz.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b609db71ed7505a9b458146de415ad73fc203dc1503bec8640b1a517c8ad6cd

File Explorer

7b609db71ed7505a9b458146de415ad73fc203dc1503bec8640b1a517c8ad6cd

.exe 45KB

7b609db71ed7505a9b458146de415ad73fc203dc1503bec8640b1a517c8ad6cd

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7b609db71ed7505a9b458146de415ad73fc203dc1503bec8640b1a517c8ad6cd
MD5 772a2606ca7ba66e9a0851fd968705eb
SHA1 ad523a935fcd50c1ba3ef4392141d7add85154b1
SHA512 89107d47eb661117401aa81cac3ebd5a84fe012a08b0b91d5658776248cc7fe9a73026eb37a1c84c2720da8665d31340c151088e97e94c398ed5b2378bb80c0b
SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qrdcP0pycvHPIjzjbYgX3iyvYMGUmzhZklXBDZ0x:ruKQpTAOX2QccMcvgj3bPXSjImzhZk30
TLSH
T1B6233B0037E8823BF2BF4F789DF26245467AF6632603D5491CC441DB5623BC69A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

7b609db71ed7505a9b458146de415ad73fc203dc1503bec8640b1a517c8ad6cd

mscoree

dotnet