asyncrat | 58eb5449affbfbcbd4316af57a4f4b7ee1e794a005017fa29664d44a7dacf584

Sharing

Copy URL Twitter E-mail

General

Target
58eb5449affbfbcbd4316af57a4f4b7ee1e794a005017fa29664d44a7dacf584
Size 45KB
Sample260715-nnec2sev8s
SHA256 58eb5449affbfbcbd4316af57a4f4b7ee1e794a005017fa29664d44a7dacf584
MD5 c1cbb2445ea2fb828fc656cfa17e3f7b
SHA1 681cabf19b005a908115d7c0e0a04032df3e0933
SHA512 22dabd7259baae9ec7b77a337ad08a40ce39fcb5a087d5dbc35c34953320b41632def9ec60062a3a5cc317cae9fe7d5278875a79697feabbf5ca182ac26782c1
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9e/NYssPJZOPIczzjbZgXQiyog3OpujMJvUCkQ4K+5:0u1YJTHcw2RHIf3cz3b2XtyPOAjOvdkB
TLSH
T150232C003BE8822BF2BE5F78ACE26145467EE5677603D94A1CC451DB4713FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

sexviet.me:80
sexviet.me:22
sexviet.me:8080
sexviet.me:8880
sexviet.me:2052
sexviet.me:2082
sexviet.me:2086
sexviet.me:2095
sexviet.me:443
sexviet.me:2053
sexviet.me:2083
sexviet.me:2087
sexviet.me:2096
sexviet.me:8443
www.sexviet.me:80
www.sexviet.me:22
www.sexviet.me:8080
www.sexviet.me:8880
www.sexviet.me:2052
www.sexviet.me:2082
www.sexviet.me:2086
www.sexviet.me:2095
www.sexviet.me:443
www.sexviet.me:2053
www.sexviet.me:2083
www.sexviet.me:2087
www.sexviet.me:2096
www.sexviet.me:8443
sodinokibi.sexviet.me:80
sodinokibi.sexviet.me:22
sodinokibi.sexviet.me:8080
sodinokibi.sexviet.me:8880
sodinokibi.sexviet.me:2052
sodinokibi.sexviet.me:2082
sodinokibi.sexviet.me:2086
sodinokibi.sexviet.me:2095
sodinokibi.sexviet.me:443
sodinokibi.sexviet.me:2053
sodinokibi.sexviet.me:2083
sodinokibi.sexviet.me:2087
sodinokibi.sexviet.me:2096
sodinokibi.sexviet.me:8443
cryptolocker.sexviet.me:80
cryptolocker.sexviet.me:22
cryptolocker.sexviet.me:8080
cryptolocker.sexviet.me:8880
cryptolocker.sexviet.me:2052
cryptolocker.sexviet.me:2082
cryptolocker.sexviet.me:2086
cryptolocker.sexviet.me:2095
cryptolocker.sexviet.me:443
cryptolocker.sexviet.me:2053
cryptolocker.sexviet.me:2083
cryptolocker.sexviet.me:2087
cryptolocker.sexviet.me:2096
cryptolocker.sexviet.me:8443
codered.sexviet.me:80
codered.sexviet.me:22
codered.sexviet.me:8080
codered.sexviet.me:8880
codered.sexviet.me:2052
codered.sexviet.me:2082
codered.sexviet.me:2086
codered.sexviet.me:2095
codered.sexviet.me:443
codered.sexviet.me:2053
codered.sexviet.me:2083
codered.sexviet.me:2087
codered.sexviet.me:2096
codered.sexviet.me:8443

Mutex

LSc0BWVsLVaL

Attributes

delay
0
install
true
install_file
becp2q.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
58eb5449affbfbcbd4316af57a4f4b7ee1e794a005017fa29664d44a7dacf584

File Explorer

58eb5449affbfbcbd4316af57a4f4b7ee1e794a005017fa29664d44a7dacf584

.exe 45KB

58eb5449affbfbcbd4316af57a4f4b7ee1e794a005017fa29664d44a7dacf584

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 58eb5449affbfbcbd4316af57a4f4b7ee1e794a005017fa29664d44a7dacf584
MD5 c1cbb2445ea2fb828fc656cfa17e3f7b
SHA1 681cabf19b005a908115d7c0e0a04032df3e0933
SHA512 22dabd7259baae9ec7b77a337ad08a40ce39fcb5a087d5dbc35c34953320b41632def9ec60062a3a5cc317cae9fe7d5278875a79697feabbf5ca182ac26782c1
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9e/NYssPJZOPIczzjbZgXQiyog3OpujMJvUCkQ4K+5:0u1YJTHcw2RHIf3cz3b2XtyPOAjOvdkB
TLSH
T150232C003BE8822BF2BE5F78ACE26145467EE5677603D94A1CC451DB4713FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

58eb5449affbfbcbd4316af57a4f4b7ee1e794a005017fa29664d44a7dacf584

mscoree

dotnet