asyncrat | ca05fc41bdc62990389891891b8983a252b08c44c34aff51522a7863824cdb2c

Sharing

Copy URL Twitter E-mail

General

Target
ca05fc41bdc62990389891891b8983a252b08c44c34aff51522a7863824cdb2c
Size 45KB
Sample260804-scd1cscf32
SHA256 ca05fc41bdc62990389891891b8983a252b08c44c34aff51522a7863824cdb2c
MD5 73886e58b64e54d472a5bed56aad0739
SHA1 e08752455569a0f2757a1883a8969d993bd1084c
SHA512 f3e876773e1bf5138a2d6adb43fda223b21607db78e8d099b9cae713749e6cc9180d4358747d07d3caa3b47e4023dc1d71a16dc984c63f0c65294d28890a0159
SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbtCSwTMjPIubjbegX3i8nqPASGbJQTDtmCBDZcx:Du2M5TQif24g1uPbhXS8nqPZGbJstlde
TLSH
T199230A1037E8812BF2BE5F78A9F26145867AF2633603D5492CC442DB5723FC696426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexvietnam.com:80
fimsexvietnam.com:22
fimsexvietnam.com:8080
fimsexvietnam.com:8880
fimsexvietnam.com:2052
fimsexvietnam.com:2082
fimsexvietnam.com:2086
fimsexvietnam.com:2095
fimsexvietnam.com:443
fimsexvietnam.com:2053
fimsexvietnam.com:2083
fimsexvietnam.com:2087
fimsexvietnam.com:2096
fimsexvietnam.com:8443
www.fimsexvietnam.com:80
www.fimsexvietnam.com:22
www.fimsexvietnam.com:8080
www.fimsexvietnam.com:8880
www.fimsexvietnam.com:2052
www.fimsexvietnam.com:2082
www.fimsexvietnam.com:2086
www.fimsexvietnam.com:2095
www.fimsexvietnam.com:443
www.fimsexvietnam.com:2053
www.fimsexvietnam.com:2083
www.fimsexvietnam.com:2087
www.fimsexvietnam.com:2096
www.fimsexvietnam.com:8443
formbook.fimsexvietnam.com:80
formbook.fimsexvietnam.com:22
formbook.fimsexvietnam.com:8080
formbook.fimsexvietnam.com:8880
formbook.fimsexvietnam.com:2052
formbook.fimsexvietnam.com:2082
formbook.fimsexvietnam.com:2086
formbook.fimsexvietnam.com:2095
formbook.fimsexvietnam.com:443
formbook.fimsexvietnam.com:2053
formbook.fimsexvietnam.com:2083
formbook.fimsexvietnam.com:2087
formbook.fimsexvietnam.com:2096
formbook.fimsexvietnam.com:8443
sodinokibi.fimsexvietnam.com:80
sodinokibi.fimsexvietnam.com:22
sodinokibi.fimsexvietnam.com:8080
sodinokibi.fimsexvietnam.com:8880
sodinokibi.fimsexvietnam.com:2052
sodinokibi.fimsexvietnam.com:2082
sodinokibi.fimsexvietnam.com:2086
sodinokibi.fimsexvietnam.com:2095
sodinokibi.fimsexvietnam.com:443
sodinokibi.fimsexvietnam.com:2053
sodinokibi.fimsexvietnam.com:2083
sodinokibi.fimsexvietnam.com:2087
sodinokibi.fimsexvietnam.com:2096
sodinokibi.fimsexvietnam.com:8443
notpetya.fimsexvietnam.com:80
notpetya.fimsexvietnam.com:22
notpetya.fimsexvietnam.com:8080
notpetya.fimsexvietnam.com:8880
notpetya.fimsexvietnam.com:2052
notpetya.fimsexvietnam.com:2082
notpetya.fimsexvietnam.com:2086
notpetya.fimsexvietnam.com:2095
notpetya.fimsexvietnam.com:443
notpetya.fimsexvietnam.com:2053
notpetya.fimsexvietnam.com:2083
notpetya.fimsexvietnam.com:2087
notpetya.fimsexvietnam.com:2096
notpetya.fimsexvietnam.com:8443
ursnif.fimsexvietnam.com:80
ursnif.fimsexvietnam.com:22
ursnif.fimsexvietnam.com:8080
ursnif.fimsexvietnam.com:8880
ursnif.fimsexvietnam.com:2052
ursnif.fimsexvietnam.com:2082
ursnif.fimsexvietnam.com:2086
ursnif.fimsexvietnam.com:2095
ursnif.fimsexvietnam.com:443
ursnif.fimsexvietnam.com:2053
ursnif.fimsexvietnam.com:2083
ursnif.fimsexvietnam.com:2087
ursnif.fimsexvietnam.com:2096
ursnif.fimsexvietnam.com:8443

Mutex

vUbcgvPFgihQ

Attributes

delay
0
install
true
install_file
obmtl6.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca05fc41bdc62990389891891b8983a252b08c44c34aff51522a7863824cdb2c

File Explorer

ca05fc41bdc62990389891891b8983a252b08c44c34aff51522a7863824cdb2c

.exe 45KB

ca05fc41bdc62990389891891b8983a252b08c44c34aff51522a7863824cdb2c

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ca05fc41bdc62990389891891b8983a252b08c44c34aff51522a7863824cdb2c
MD5 73886e58b64e54d472a5bed56aad0739
SHA1 e08752455569a0f2757a1883a8969d993bd1084c
SHA512 f3e876773e1bf5138a2d6adb43fda223b21607db78e8d099b9cae713749e6cc9180d4358747d07d3caa3b47e4023dc1d71a16dc984c63f0c65294d28890a0159
SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbtCSwTMjPIubjbegX3i8nqPASGbJQTDtmCBDZcx:Du2M5TQif24g1uPbhXS8nqPZGbJstlde
TLSH
T199230A1037E8812BF2BE5F78A9F26145867AF2633603D5492CC442DB5723FC696426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ca05fc41bdc62990389891891b8983a252b08c44c34aff51522a7863824cdb2c

mscoree

dotnet