asyncrat | db8a7113-f8ee-4de2-8eeb-1a4985654e47[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
db8a7113-f8ee-4de2-8eeb-1a4985654e47.exe
Size 46KB
Sample260727-meastsad86
SHA256 a2c0ed93760054ea0dc0718e8ace4c75ec08542bab565ec7038986416749f478
MD5 7f43ff258c0a52d58f9eeeb9ba08a9ef
SHA1 1788069c8e7869e3d4692ef2af7f80a7f7a67da7
SHA512 744b2b7a54b7677a2b2485d9912b640da064af125a41ae5ec973c967b26dd1fb8d6c4bdf40ae4f15e370b3f8026f557ed26d077827f6bed7fc4e3a3c245220dd
SSDEEP 768:IaPs6mLzaGjxvdwFGJx8OxBzJKHG1PDAIjbRg47FrEcVbUBfUmM5b2f+l:IaPsRKdsFDHbe4hrtbUzM5b2f+l
TLSH
T113231B043BECC227F2BE4F7899F2624586B6F6532603DA491CC812D65613FC5DE426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

388pg88.com:4930
388pg88.com:0921
388pg88.com:1123
388pg88.com:8362
388pg88.com:3439
388pg88.com:2551
388pg88.com:5786
388pg88.com:7404
388pg88.com:2158
388pg88.com:8075
www.388pg88.com:4930
www.388pg88.com:0921
www.388pg88.com:1123
www.388pg88.com:8362
www.388pg88.com:3439
www.388pg88.com:2551
www.388pg88.com:5786
www.388pg88.com:7404
www.388pg88.com:2158
www.388pg88.com:8075
NotPetya.388pg88.com:4930
NotPetya.388pg88.com:0921
NotPetya.388pg88.com:1123
NotPetya.388pg88.com:8362
NotPetya.388pg88.com:3439
NotPetya.388pg88.com:2551
NotPetya.388pg88.com:5786
NotPetya.388pg88.com:7404
NotPetya.388pg88.com:2158
NotPetya.388pg88.com:8075
Stuxnet.388pg88.com:4930
Stuxnet.388pg88.com:0921
Stuxnet.388pg88.com:1123
Stuxnet.388pg88.com:8362
Stuxnet.388pg88.com:3439
Stuxnet.388pg88.com:2551
Stuxnet.388pg88.com:5786
Stuxnet.388pg88.com:7404
Stuxnet.388pg88.com:2158
Stuxnet.388pg88.com:8075
Zeus.388pg88.com:4930
Zeus.388pg88.com:0921
Zeus.388pg88.com:1123
Zeus.388pg88.com:8362
Zeus.388pg88.com:3439
Zeus.388pg88.com:2551
Zeus.388pg88.com:5786
Zeus.388pg88.com:7404
Zeus.388pg88.com:2158
Zeus.388pg88.com:8075
CryptoLocker.388pg88.com:4930
CryptoLocker.388pg88.com:0921
CryptoLocker.388pg88.com:1123
CryptoLocker.388pg88.com:8362
CryptoLocker.388pg88.com:3439
CryptoLocker.388pg88.com:2551
CryptoLocker.388pg88.com:5786
CryptoLocker.388pg88.com:7404
CryptoLocker.388pg88.com:2158
CryptoLocker.388pg88.com:8075
388pg88.com/vi-vn/%3A9292:4930
388pg88.com/vi-vn/%3A9292:0921
388pg88.com/vi-vn/%3A9292:1123
388pg88.com/vi-vn/%3A9292:8362
388pg88.com/vi-vn/%3A9292:3439
388pg88.com/vi-vn/%3A9292:2551
388pg88.com/vi-vn/%3A9292:5786
388pg88.com/vi-vn/%3A9292:7404
388pg88.com/vi-vn/%3A9292:2158
388pg88.com/vi-vn/%3A9292:8075
388pg88.com/vi-vn/%3A7106:4930
388pg88.com/vi-vn/%3A7106:0921
388pg88.com/vi-vn/%3A7106:1123
388pg88.com/vi-vn/%3A7106:8362
388pg88.com/vi-vn/%3A7106:3439
388pg88.com/vi-vn/%3A7106:2551
388pg88.com/vi-vn/%3A7106:5786
388pg88.com/vi-vn/%3A7106:7404
388pg88.com/vi-vn/%3A7106:2158
388pg88.com/vi-vn/%3A7106:8075
388pg88.com/vi-vn/%3A4251:4930
388pg88.com/vi-vn/%3A4251:0921
388pg88.com/vi-vn/%3A4251:1123
388pg88.com/vi-vn/%3A4251:8362
388pg88.com/vi-vn/%3A4251:3439
388pg88.com/vi-vn/%3A4251:2551
388pg88.com/vi-vn/%3A4251:5786
388pg88.com/vi-vn/%3A4251:7404
388pg88.com/vi-vn/%3A4251:2158
388pg88.com/vi-vn/%3A4251:8075
388pg88.com/vi-vn/%3A3841:4930
388pg88.com/vi-vn/%3A3841:0921
388pg88.com/vi-vn/%3A3841:1123
388pg88.com/vi-vn/%3A3841:8362
388pg88.com/vi-vn/%3A3841:3439
388pg88.com/vi-vn/%3A3841:2551
388pg88.com/vi-vn/%3A3841:5786
388pg88.com/vi-vn/%3A3841:7404
388pg88.com/vi-vn/%3A3841:2158
388pg88.com/vi-vn/%3A3841:8075
388pg88.com/vi-vn/%3A6657:4930
388pg88.com/vi-vn/%3A6657:0921
388pg88.com/vi-vn/%3A6657:1123
388pg88.com/vi-vn/%3A6657:8362
388pg88.com/vi-vn/%3A6657:3439
388pg88.com/vi-vn/%3A6657:2551
388pg88.com/vi-vn/%3A6657:5786
388pg88.com/vi-vn/%3A6657:7404
388pg88.com/vi-vn/%3A6657:2158
388pg88.com/vi-vn/%3A6657:8075
388pg88.com/vi-vn/%3A9669:4930
388pg88.com/vi-vn/%3A9669:0921
388pg88.com/vi-vn/%3A9669:1123
388pg88.com/vi-vn/%3A9669:8362
388pg88.com/vi-vn/%3A9669:3439
388pg88.com/vi-vn/%3A9669:2551
388pg88.com/vi-vn/%3A9669:5786
388pg88.com/vi-vn/%3A9669:7404
388pg88.com/vi-vn/%3A9669:2158
388pg88.com/vi-vn/%3A9669:8075
388pg88.com/vi-vn/%3A3665:4930
388pg88.com/vi-vn/%3A3665:0921
388pg88.com/vi-vn/%3A3665:1123
388pg88.com/vi-vn/%3A3665:8362
388pg88.com/vi-vn/%3A3665:3439
388pg88.com/vi-vn/%3A3665:2551
388pg88.com/vi-vn/%3A3665:5786
388pg88.com/vi-vn/%3A3665:7404
388pg88.com/vi-vn/%3A3665:2158
388pg88.com/vi-vn/%3A3665:8075

Mutex

6MOCJMTjUj3O

Attributes

delay
3
install
true
install_file
pg888.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db8a7113-f8ee-4de2-8eeb-1a4985654e47.exe

File Explorer

db8a7113-f8ee-4de2-8eeb-1a4985654e47.exe

.exe 46KB

db8a7113-f8ee-4de2-8eeb-1a4985654e47.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a2c0ed93760054ea0dc0718e8ace4c75ec08542bab565ec7038986416749f478
MD5 7f43ff258c0a52d58f9eeeb9ba08a9ef
SHA1 1788069c8e7869e3d4692ef2af7f80a7f7a67da7
SHA512 744b2b7a54b7677a2b2485d9912b640da064af125a41ae5ec973c967b26dd1fb8d6c4bdf40ae4f15e370b3f8026f557ed26d077827f6bed7fc4e3a3c245220dd
SSDEEP 768:IaPs6mLzaGjxvdwFGJx8OxBzJKHG1PDAIjbRg47FrEcVbUBfUmM5b2f+l:IaPsRKdsFDHbe4hrtbUzM5b2f+l
TLSH
T113231B043BECC227F2BE4F7899F2624586B6F6532603DA491CC812D65613FC5DE426FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

db8a7113-f8ee-4de2-8eeb-1a4985654e47.exe

mscoree

dotnet