asyncrat | 538ad8e4-e932-4a38-8a1f-eb7af19157e4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
538ad8e4-e932-4a38-8a1f-eb7af19157e4.exe
Size 46KB
Sample260804-pps39swybz
SHA256 f9ce4f07f13cb5a2f30bf782833d91ed4c352e89543ff40bbe975162d73e6c4a
MD5 3df194c7b40b81fe15116956ee15e0d2
SHA1 89b32ff2b60d925e0caac0460114baa98ae5749b
SHA512 159b56f8430b75766dbc6b3399575adcfa6c7669a41529b8d0d27cbd74573d7ca64cca42aad2a68beae238582b4388de09f2b6e7e39b329e6335122ae26c374e
SSDEEP 768:Qak0CLeA7rxvFwJGEx8T72hA9w1PKJIjb6g4ZFf4XDYrvBZ/8oNmM5bGf+R:Qak0CJdv3SKKbt4TfQYVZ/eM5bGf+R
TLSH
T1F52329007BED822AF2BE9F7899F2224546B9F2532603D5491C8812DB5613FC1CB426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

pg55.bingo:4441
pg55.bingo:1756
pg55.bingo:1250
pg55.bingo:5126
pg55.bingo:4738
pg55.bingo:7097
pg55.bingo:8235
www.pg55.bingo:4441
www.pg55.bingo:1756
www.pg55.bingo:1250
www.pg55.bingo:5126
www.pg55.bingo:4738
www.pg55.bingo:7097
www.pg55.bingo:8235
NotPetya.pg55.bingo:4441
NotPetya.pg55.bingo:1756
NotPetya.pg55.bingo:1250
NotPetya.pg55.bingo:5126
NotPetya.pg55.bingo:4738
NotPetya.pg55.bingo:7097
NotPetya.pg55.bingo:8235
Stuxnet.pg55.bingo:4441
Stuxnet.pg55.bingo:1756
Stuxnet.pg55.bingo:1250
Stuxnet.pg55.bingo:5126
Stuxnet.pg55.bingo:4738
Stuxnet.pg55.bingo:7097
Stuxnet.pg55.bingo:8235
Zeus.pg55.bingo:4441
Zeus.pg55.bingo:1756
Zeus.pg55.bingo:1250
Zeus.pg55.bingo:5126
Zeus.pg55.bingo:4738
Zeus.pg55.bingo:7097
Zeus.pg55.bingo:8235
CryptoLocker.pg55.bingo:4441
CryptoLocker.pg55.bingo:1756
CryptoLocker.pg55.bingo:1250
CryptoLocker.pg55.bingo:5126
CryptoLocker.pg55.bingo:4738
CryptoLocker.pg55.bingo:7097
CryptoLocker.pg55.bingo:8235
pg55.bingo/vi-vn/%3A8405:4441
pg55.bingo/vi-vn/%3A8405:1756
pg55.bingo/vi-vn/%3A8405:1250
pg55.bingo/vi-vn/%3A8405:5126
pg55.bingo/vi-vn/%3A8405:4738
pg55.bingo/vi-vn/%3A8405:7097
pg55.bingo/vi-vn/%3A8405:8235
pg55.bingo/vi-vn/%3A1968:4441
pg55.bingo/vi-vn/%3A1968:1756
pg55.bingo/vi-vn/%3A1968:1250
pg55.bingo/vi-vn/%3A1968:5126
pg55.bingo/vi-vn/%3A1968:4738
pg55.bingo/vi-vn/%3A1968:7097
pg55.bingo/vi-vn/%3A1968:8235
pg55.bingo/vi-vn/%3A8121:4441
pg55.bingo/vi-vn/%3A8121:1756
pg55.bingo/vi-vn/%3A8121:1250
pg55.bingo/vi-vn/%3A8121:5126
pg55.bingo/vi-vn/%3A8121:4738
pg55.bingo/vi-vn/%3A8121:7097
pg55.bingo/vi-vn/%3A8121:8235
pg55.bingo/vi-vn/%3A7513:4441
pg55.bingo/vi-vn/%3A7513:1756
pg55.bingo/vi-vn/%3A7513:1250
pg55.bingo/vi-vn/%3A7513:5126
pg55.bingo/vi-vn/%3A7513:4738
pg55.bingo/vi-vn/%3A7513:7097
pg55.bingo/vi-vn/%3A7513:8235
pg55.bingo/vi-vn/%3A6606:4441
pg55.bingo/vi-vn/%3A6606:1756
pg55.bingo/vi-vn/%3A6606:1250
pg55.bingo/vi-vn/%3A6606:5126
pg55.bingo/vi-vn/%3A6606:4738
pg55.bingo/vi-vn/%3A6606:7097
pg55.bingo/vi-vn/%3A6606:8235
pg55.bingo/vi-vn/%3A2048:4441
pg55.bingo/vi-vn/%3A2048:1756
pg55.bingo/vi-vn/%3A2048:1250
pg55.bingo/vi-vn/%3A2048:5126
pg55.bingo/vi-vn/%3A2048:4738
pg55.bingo/vi-vn/%3A2048:7097
pg55.bingo/vi-vn/%3A2048:8235
pg55.bingo/vi-vn/%3A9758:4441
pg55.bingo/vi-vn/%3A9758:1756
pg55.bingo/vi-vn/%3A9758:1250
pg55.bingo/vi-vn/%3A9758:5126
pg55.bingo/vi-vn/%3A9758:4738
pg55.bingo/vi-vn/%3A9758:7097
pg55.bingo/vi-vn/%3A9758:8235

Mutex

uh4t919asRaF

Attributes

delay
3
install
true
install_file
pg55bingo.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
538ad8e4-e932-4a38-8a1f-eb7af19157e4.exe

File Explorer

538ad8e4-e932-4a38-8a1f-eb7af19157e4.exe

.exe 46KB

538ad8e4-e932-4a38-8a1f-eb7af19157e4.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f9ce4f07f13cb5a2f30bf782833d91ed4c352e89543ff40bbe975162d73e6c4a
MD5 3df194c7b40b81fe15116956ee15e0d2
SHA1 89b32ff2b60d925e0caac0460114baa98ae5749b
SHA512 159b56f8430b75766dbc6b3399575adcfa6c7669a41529b8d0d27cbd74573d7ca64cca42aad2a68beae238582b4388de09f2b6e7e39b329e6335122ae26c374e
SSDEEP 768:Qak0CLeA7rxvFwJGEx8T72hA9w1PKJIjb6g4ZFf4XDYrvBZ/8oNmM5bGf+R:Qak0CJdv3SKKbt4TfQYVZ/eM5bGf+R
TLSH
T1F52329007BED822AF2BE9F7899F2224546B9F2532603D5491C8812DB5613FC1CB426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

538ad8e4-e932-4a38-8a1f-eb7af19157e4.exe

mscoree

dotnet