asyncrat | 3c26ec9fe6b9416ec65a9c3154751663a28f6b92d69cf6eec3bf48eda7ce52c6

Sharing

Copy URL Twitter E-mail

General

Target
3c26ec9fe6b9416ec65a9c3154751663a28f6b92d69cf6eec3bf48eda7ce52c6
Size 45KB
Sample260804-kn5cpabm5v
SHA256 3c26ec9fe6b9416ec65a9c3154751663a28f6b92d69cf6eec3bf48eda7ce52c6
MD5 5339570ec4bd18a6166d52d18c94b087
SHA1 ac1fcdb0c6bda0ab404b0b65cf48be1662e1a1db
SHA512 4d5ffc3307afb4eb9c5cfb0a2133814e396e902e472c3bb09e6331f22ff4af405cbf7a6c333cb035663fb4f36fa089c22ab2eb9d15923eab3c67d53e15df0b8b
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7EHO9YjoHPICYzjbUgX3iVmlh2rTgeNzDRP89QUbf:0ushJTDXgH2a6kgCY3b7XS4aTdRP86U7
TLSH
T1CE232A003BE9812BF2BF4F7899F26145867AF6632603E54D1CC451DB5613FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimsexvnn.com:80
phimsexvnn.com:22
phimsexvnn.com:8080
phimsexvnn.com:8880
phimsexvnn.com:2052
phimsexvnn.com:2082
phimsexvnn.com:2086
phimsexvnn.com:2095
phimsexvnn.com:443
phimsexvnn.com:2053
phimsexvnn.com:2083
phimsexvnn.com:2087
phimsexvnn.com:2096
phimsexvnn.com:8443
www.phimsexvnn.com:80
www.phimsexvnn.com:22
www.phimsexvnn.com:8080
www.phimsexvnn.com:8880
www.phimsexvnn.com:2052
www.phimsexvnn.com:2082
www.phimsexvnn.com:2086
www.phimsexvnn.com:2095
www.phimsexvnn.com:443
www.phimsexvnn.com:2053
www.phimsexvnn.com:2083
www.phimsexvnn.com:2087
www.phimsexvnn.com:2096
www.phimsexvnn.com:8443
downadup.phimsexvnn.com:80
downadup.phimsexvnn.com:22
downadup.phimsexvnn.com:8080
downadup.phimsexvnn.com:8880
downadup.phimsexvnn.com:2052
downadup.phimsexvnn.com:2082
downadup.phimsexvnn.com:2086
downadup.phimsexvnn.com:2095
downadup.phimsexvnn.com:443
downadup.phimsexvnn.com:2053
downadup.phimsexvnn.com:2083
downadup.phimsexvnn.com:2087
downadup.phimsexvnn.com:2096
downadup.phimsexvnn.com:8443
notpetya.phimsexvnn.com:80
notpetya.phimsexvnn.com:22
notpetya.phimsexvnn.com:8080
notpetya.phimsexvnn.com:8880
notpetya.phimsexvnn.com:2052
notpetya.phimsexvnn.com:2082
notpetya.phimsexvnn.com:2086
notpetya.phimsexvnn.com:2095
notpetya.phimsexvnn.com:443
notpetya.phimsexvnn.com:2053
notpetya.phimsexvnn.com:2083
notpetya.phimsexvnn.com:2087
notpetya.phimsexvnn.com:2096
notpetya.phimsexvnn.com:8443
melissa.phimsexvnn.com:80
melissa.phimsexvnn.com:22
melissa.phimsexvnn.com:8080
melissa.phimsexvnn.com:8880
melissa.phimsexvnn.com:2052
melissa.phimsexvnn.com:2082
melissa.phimsexvnn.com:2086
melissa.phimsexvnn.com:2095
melissa.phimsexvnn.com:443
melissa.phimsexvnn.com:2053
melissa.phimsexvnn.com:2083
melissa.phimsexvnn.com:2087
melissa.phimsexvnn.com:2096
melissa.phimsexvnn.com:8443
agenttesla.phimsexvnn.com:80
agenttesla.phimsexvnn.com:22
agenttesla.phimsexvnn.com:8080
agenttesla.phimsexvnn.com:8880
agenttesla.phimsexvnn.com:2052
agenttesla.phimsexvnn.com:2082
agenttesla.phimsexvnn.com:2086
agenttesla.phimsexvnn.com:2095
agenttesla.phimsexvnn.com:443
agenttesla.phimsexvnn.com:2053
agenttesla.phimsexvnn.com:2083
agenttesla.phimsexvnn.com:2087
agenttesla.phimsexvnn.com:2096
agenttesla.phimsexvnn.com:8443

Mutex

25huLQNAwrdc

Attributes

delay
0
install
true
install_file
vy0gzz.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c26ec9fe6b9416ec65a9c3154751663a28f6b92d69cf6eec3bf48eda7ce52c6

File Explorer

3c26ec9fe6b9416ec65a9c3154751663a28f6b92d69cf6eec3bf48eda7ce52c6

.exe 45KB

3c26ec9fe6b9416ec65a9c3154751663a28f6b92d69cf6eec3bf48eda7ce52c6

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3c26ec9fe6b9416ec65a9c3154751663a28f6b92d69cf6eec3bf48eda7ce52c6
MD5 5339570ec4bd18a6166d52d18c94b087
SHA1 ac1fcdb0c6bda0ab404b0b65cf48be1662e1a1db
SHA512 4d5ffc3307afb4eb9c5cfb0a2133814e396e902e472c3bb09e6331f22ff4af405cbf7a6c333cb035663fb4f36fa089c22ab2eb9d15923eab3c67d53e15df0b8b
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7EHO9YjoHPICYzjbUgX3iVmlh2rTgeNzDRP89QUbf:0ushJTDXgH2a6kgCY3b7XS4aTdRP86U7
TLSH
T1CE232A003BE9812BF2BF4F7899F26145867AF6632603E54D1CC451DB5613FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

3c26ec9fe6b9416ec65a9c3154751663a28f6b92d69cf6eec3bf48eda7ce52c6

mscoree

dotnet