asyncrat | 3dec98b40ab9c77bf0a91527e91f2dd743f72a518d40fd128b71d95017634789

Sharing

Copy URL Twitter E-mail

General

Target
3dec98b40ab9c77bf0a91527e91f2dd743f72a518d40fd128b71d95017634789
Size 45KB
Sample260803-ndvmaahn2t
SHA256 3dec98b40ab9c77bf0a91527e91f2dd743f72a518d40fd128b71d95017634789
MD5 c135847fb7d3c64cd0ec86068ed5823b
SHA1 56d8667b7a2452063e319f6d2f0642995ae39ba7
SHA512 b626ba573b4035d26c78d1bec3b1eaa22fc6d43908b4e56bdb7ef87f929dd189630d4a19592eddea3805dbdb7992fb8180976f58d68915f83a30f2c5f95cd3a4
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFA7lt440WMOPI0szjb+gXpijMokkHmHo9xBDZEx:MuLAZTnbg2VgUM30s3bBXYGkGHQPdEx
TLSH
T190232A003BE8812BF1BE4F7899F26145467AF6636603D58E1CC452DB5723FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimvkl.com:80
phimvkl.com:22
phimvkl.com:8080
phimvkl.com:8880
phimvkl.com:2052
phimvkl.com:2082
phimvkl.com:2086
phimvkl.com:2095
phimvkl.com:443
phimvkl.com:2053
phimvkl.com:2083
phimvkl.com:2087
phimvkl.com:2096
phimvkl.com:8443
www.phimvkl.com:80
www.phimvkl.com:22
www.phimvkl.com:8080
www.phimvkl.com:8880
www.phimvkl.com:2052
www.phimvkl.com:2082
www.phimvkl.com:2086
www.phimvkl.com:2095
www.phimvkl.com:443
www.phimvkl.com:2053
www.phimvkl.com:2083
www.phimvkl.com:2087
www.phimvkl.com:2096
www.phimvkl.com:8443
malware.phimvkl.com:80
malware.phimvkl.com:22
malware.phimvkl.com:8080
malware.phimvkl.com:8880
malware.phimvkl.com:2052
malware.phimvkl.com:2082
malware.phimvkl.com:2086
malware.phimvkl.com:2095
malware.phimvkl.com:443
malware.phimvkl.com:2053
malware.phimvkl.com:2083
malware.phimvkl.com:2087
malware.phimvkl.com:2096
malware.phimvkl.com:8443
ryuk.phimvkl.com:80
ryuk.phimvkl.com:22
ryuk.phimvkl.com:8080
ryuk.phimvkl.com:8880
ryuk.phimvkl.com:2052
ryuk.phimvkl.com:2082
ryuk.phimvkl.com:2086
ryuk.phimvkl.com:2095
ryuk.phimvkl.com:443
ryuk.phimvkl.com:2053
ryuk.phimvkl.com:2083
ryuk.phimvkl.com:2087
ryuk.phimvkl.com:2096
ryuk.phimvkl.com:8443
lokibot.phimvkl.com:80
lokibot.phimvkl.com:22
lokibot.phimvkl.com:8080
lokibot.phimvkl.com:8880
lokibot.phimvkl.com:2052
lokibot.phimvkl.com:2082
lokibot.phimvkl.com:2086
lokibot.phimvkl.com:2095
lokibot.phimvkl.com:443
lokibot.phimvkl.com:2053
lokibot.phimvkl.com:2083
lokibot.phimvkl.com:2087
lokibot.phimvkl.com:2096
lokibot.phimvkl.com:8443
stuxnet.phimvkl.com:80
stuxnet.phimvkl.com:22
stuxnet.phimvkl.com:8080
stuxnet.phimvkl.com:8880
stuxnet.phimvkl.com:2052
stuxnet.phimvkl.com:2082
stuxnet.phimvkl.com:2086
stuxnet.phimvkl.com:2095
stuxnet.phimvkl.com:443
stuxnet.phimvkl.com:2053
stuxnet.phimvkl.com:2083
stuxnet.phimvkl.com:2087
stuxnet.phimvkl.com:2096
stuxnet.phimvkl.com:8443

Mutex

4D8AR0e8xT7l

Attributes

delay
0
install
true
install_file
l186o.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3dec98b40ab9c77bf0a91527e91f2dd743f72a518d40fd128b71d95017634789

File Explorer

3dec98b40ab9c77bf0a91527e91f2dd743f72a518d40fd128b71d95017634789

.exe 45KB

3dec98b40ab9c77bf0a91527e91f2dd743f72a518d40fd128b71d95017634789

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3dec98b40ab9c77bf0a91527e91f2dd743f72a518d40fd128b71d95017634789
MD5 c135847fb7d3c64cd0ec86068ed5823b
SHA1 56d8667b7a2452063e319f6d2f0642995ae39ba7
SHA512 b626ba573b4035d26c78d1bec3b1eaa22fc6d43908b4e56bdb7ef87f929dd189630d4a19592eddea3805dbdb7992fb8180976f58d68915f83a30f2c5f95cd3a4
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFA7lt440WMOPI0szjb+gXpijMokkHmHo9xBDZEx:MuLAZTnbg2VgUM30s3bBXYGkGHQPdEx
TLSH
T190232A003BE8812BF1BE4F7899F26145467AF6636603D58E1CC452DB5723FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

3dec98b40ab9c77bf0a91527e91f2dd743f72a518d40fd128b71d95017634789

mscoree

dotnet