asyncrat | c178969a-78a2-414a-9586-6f9c020d050b[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
c178969a-78a2-414a-9586-6f9c020d050b.exe
Size 46KB
Sample260727-mcmdvaz1cs
SHA256 df5229380e60b829d8c243e96c79b2aa974b5f0977df2934692ee2aa8242ef96
MD5 0ecaa4d67f66adfda6c0224d0e947ccb
SHA1 8199d65589860df0ac4a91ff0fdf043aa320ffb0
SHA512 e400e210f1da686b93327539550d4e469309abf70fe25128c1029b37049528015fb4f227193e718855f454a8426b6652ef42141b4f0ebb15cd4657298609218a
SSDEEP 768:QaMepLKWmdJxvfwzGUx8Umyhdj3G1PEJIjbrg47Fpdxf3STk4YRmM5bGf+S:QaMep2BLyuEKbU4hpz3GkYM5bGf+S
TLSH
T183232B003BEC822BF1BE9F78A9F27246457AF6633603D55A1CC411DA1613FC5CA426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

bet88.ooo:4930
bet88.ooo:0921
bet88.ooo:1123
bet88.ooo:8362
bet88.ooo:3439
bet88.ooo:2551
bet88.ooo:5786
bet88.ooo:7404
bet88.ooo:2158
bet88.ooo:8075
www.bet88.ooo:4930
www.bet88.ooo:0921
www.bet88.ooo:1123
www.bet88.ooo:8362
www.bet88.ooo:3439
www.bet88.ooo:2551
www.bet88.ooo:5786
www.bet88.ooo:7404
www.bet88.ooo:2158
www.bet88.ooo:8075
NotPetya.bet88.ooo:4930
NotPetya.bet88.ooo:0921
NotPetya.bet88.ooo:1123
NotPetya.bet88.ooo:8362
NotPetya.bet88.ooo:3439
NotPetya.bet88.ooo:2551
NotPetya.bet88.ooo:5786
NotPetya.bet88.ooo:7404
NotPetya.bet88.ooo:2158
NotPetya.bet88.ooo:8075
Stuxnet.bet88.ooo:4930
Stuxnet.bet88.ooo:0921
Stuxnet.bet88.ooo:1123
Stuxnet.bet88.ooo:8362
Stuxnet.bet88.ooo:3439
Stuxnet.bet88.ooo:2551
Stuxnet.bet88.ooo:5786
Stuxnet.bet88.ooo:7404
Stuxnet.bet88.ooo:2158
Stuxnet.bet88.ooo:8075
Zeus.bet88.ooo:4930
Zeus.bet88.ooo:0921
Zeus.bet88.ooo:1123
Zeus.bet88.ooo:8362
Zeus.bet88.ooo:3439
Zeus.bet88.ooo:2551
Zeus.bet88.ooo:5786
Zeus.bet88.ooo:7404
Zeus.bet88.ooo:2158
Zeus.bet88.ooo:8075
CryptoLocker.bet88.ooo:4930
CryptoLocker.bet88.ooo:0921
CryptoLocker.bet88.ooo:1123
CryptoLocker.bet88.ooo:8362
CryptoLocker.bet88.ooo:3439
CryptoLocker.bet88.ooo:2551
CryptoLocker.bet88.ooo:5786
CryptoLocker.bet88.ooo:7404
CryptoLocker.bet88.ooo:2158
CryptoLocker.bet88.ooo:8075
bet88.ooo/vi-vn/%3A1012:4930
bet88.ooo/vi-vn/%3A1012:0921
bet88.ooo/vi-vn/%3A1012:1123
bet88.ooo/vi-vn/%3A1012:8362
bet88.ooo/vi-vn/%3A1012:3439
bet88.ooo/vi-vn/%3A1012:2551
bet88.ooo/vi-vn/%3A1012:5786
bet88.ooo/vi-vn/%3A1012:7404
bet88.ooo/vi-vn/%3A1012:2158
bet88.ooo/vi-vn/%3A1012:8075
bet88.ooo/vi-vn/%3A2490:4930
bet88.ooo/vi-vn/%3A2490:0921
bet88.ooo/vi-vn/%3A2490:1123
bet88.ooo/vi-vn/%3A2490:8362
bet88.ooo/vi-vn/%3A2490:3439
bet88.ooo/vi-vn/%3A2490:2551
bet88.ooo/vi-vn/%3A2490:5786
bet88.ooo/vi-vn/%3A2490:7404
bet88.ooo/vi-vn/%3A2490:2158
bet88.ooo/vi-vn/%3A2490:8075
bet88.ooo/vi-vn/%3A1920:4930
bet88.ooo/vi-vn/%3A1920:0921
bet88.ooo/vi-vn/%3A1920:1123
bet88.ooo/vi-vn/%3A1920:8362
bet88.ooo/vi-vn/%3A1920:3439
bet88.ooo/vi-vn/%3A1920:2551
bet88.ooo/vi-vn/%3A1920:5786
bet88.ooo/vi-vn/%3A1920:7404
bet88.ooo/vi-vn/%3A1920:2158
bet88.ooo/vi-vn/%3A1920:8075
bet88.ooo/vi-vn/%3A7552:4930
bet88.ooo/vi-vn/%3A7552:0921
bet88.ooo/vi-vn/%3A7552:1123
bet88.ooo/vi-vn/%3A7552:8362
bet88.ooo/vi-vn/%3A7552:3439
bet88.ooo/vi-vn/%3A7552:2551
bet88.ooo/vi-vn/%3A7552:5786
bet88.ooo/vi-vn/%3A7552:7404
bet88.ooo/vi-vn/%3A7552:2158
bet88.ooo/vi-vn/%3A7552:8075
bet88.ooo/vi-vn/%3A3466:4930
bet88.ooo/vi-vn/%3A3466:0921
bet88.ooo/vi-vn/%3A3466:1123
bet88.ooo/vi-vn/%3A3466:8362
bet88.ooo/vi-vn/%3A3466:3439
bet88.ooo/vi-vn/%3A3466:2551
bet88.ooo/vi-vn/%3A3466:5786
bet88.ooo/vi-vn/%3A3466:7404
bet88.ooo/vi-vn/%3A3466:2158
bet88.ooo/vi-vn/%3A3466:8075
bet88.ooo/vi-vn/%3A7220:4930
bet88.ooo/vi-vn/%3A7220:0921
bet88.ooo/vi-vn/%3A7220:1123
bet88.ooo/vi-vn/%3A7220:8362
bet88.ooo/vi-vn/%3A7220:3439
bet88.ooo/vi-vn/%3A7220:2551
bet88.ooo/vi-vn/%3A7220:5786
bet88.ooo/vi-vn/%3A7220:7404
bet88.ooo/vi-vn/%3A7220:2158
bet88.ooo/vi-vn/%3A7220:8075
bet88.ooo/vi-vn/%3A8268:4930
bet88.ooo/vi-vn/%3A8268:0921
bet88.ooo/vi-vn/%3A8268:1123
bet88.ooo/vi-vn/%3A8268:8362
bet88.ooo/vi-vn/%3A8268:3439
bet88.ooo/vi-vn/%3A8268:2551
bet88.ooo/vi-vn/%3A8268:5786
bet88.ooo/vi-vn/%3A8268:7404
bet88.ooo/vi-vn/%3A8268:2158
bet88.ooo/vi-vn/%3A8268:8075

Mutex

sIWFGiEPmbPs

Attributes

delay
3
install
true
install_file
bet884.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c178969a-78a2-414a-9586-6f9c020d050b.exe

File Explorer

c178969a-78a2-414a-9586-6f9c020d050b.exe

.exe 46KB

c178969a-78a2-414a-9586-6f9c020d050b.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 df5229380e60b829d8c243e96c79b2aa974b5f0977df2934692ee2aa8242ef96
MD5 0ecaa4d67f66adfda6c0224d0e947ccb
SHA1 8199d65589860df0ac4a91ff0fdf043aa320ffb0
SHA512 e400e210f1da686b93327539550d4e469309abf70fe25128c1029b37049528015fb4f227193e718855f454a8426b6652ef42141b4f0ebb15cd4657298609218a
SSDEEP 768:QaMepLKWmdJxvfwzGUx8Umyhdj3G1PEJIjbrg47Fpdxf3STk4YRmM5bGf+S:QaMep2BLyuEKbU4hpz3GkYM5bGf+S
TLSH
T183232B003BEC822BF1BE9F78A9F27246457AF6633603D55A1CC411DA1613FC5CA426FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c178969a-78a2-414a-9586-6f9c020d050b.exe

mscoree

dotnet