asyncrat | 39d3f449-fe5e-4e4f-98f0-6257683e136d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
39d3f449-fe5e-4e4f-98f0-6257683e136d.exe
Size 46KB
Sample260805-kpp96ayth1
SHA256 8e5e2e343bae17b1a8f26bb0342fe56fac28b2bd593deb46be9763bb9f4ceceb
MD5 74fb409637fbc2d572d9b578114d1d2a
SHA1 b09f88b244bd52d6f08bdd166f8fcdf9dbc048b9
SHA512 ce401f15c4fa9326597dfe00180611e62d8ac7cfb003cca856962e2de0e91a27a1156345db6a922d0fd24f837188140ebce0b42fa38c5b0cfb94367f69407511
SSDEEP 768:Qak0CLeA7rxvFwJGEx8RbkPOavH1PIJIjbwRg47F0SFHSnEnb+SRCTTFmM5bGf+J:Qak0CJdRIbhIKb/4h1FynqM5bGf+J
TLSH
T106232B003BE98226F2BE9F749DF26245467AF2632603D64E1CC412D75613FC5DA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

p3bet.live:6962
p3bet.live:7287
p3bet.live:9425
p3bet.live:9965
p3bet.live:4032
p3bet.live:4874
p3bet.live:6618
www.p3bet.live:6962
www.p3bet.live:7287
www.p3bet.live:9425
www.p3bet.live:9965
www.p3bet.live:4032
www.p3bet.live:4874
www.p3bet.live:6618
NotPetya.p3bet.live:6962
NotPetya.p3bet.live:7287
NotPetya.p3bet.live:9425
NotPetya.p3bet.live:9965
NotPetya.p3bet.live:4032
NotPetya.p3bet.live:4874
NotPetya.p3bet.live:6618
Stuxnet.p3bet.live:6962
Stuxnet.p3bet.live:7287
Stuxnet.p3bet.live:9425
Stuxnet.p3bet.live:9965
Stuxnet.p3bet.live:4032
Stuxnet.p3bet.live:4874
Stuxnet.p3bet.live:6618
Zeus.p3bet.live:6962
Zeus.p3bet.live:7287
Zeus.p3bet.live:9425
Zeus.p3bet.live:9965
Zeus.p3bet.live:4032
Zeus.p3bet.live:4874
Zeus.p3bet.live:6618
CryptoLocker.p3bet.live:6962
CryptoLocker.p3bet.live:7287
CryptoLocker.p3bet.live:9425
CryptoLocker.p3bet.live:9965
CryptoLocker.p3bet.live:4032
CryptoLocker.p3bet.live:4874
CryptoLocker.p3bet.live:6618
p3bet.live/vi-vn/%3A3596:6962
p3bet.live/vi-vn/%3A3596:7287
p3bet.live/vi-vn/%3A3596:9425
p3bet.live/vi-vn/%3A3596:9965
p3bet.live/vi-vn/%3A3596:4032
p3bet.live/vi-vn/%3A3596:4874
p3bet.live/vi-vn/%3A3596:6618
p3bet.live/vi-vn/%3A5919:6962
p3bet.live/vi-vn/%3A5919:7287
p3bet.live/vi-vn/%3A5919:9425
p3bet.live/vi-vn/%3A5919:9965
p3bet.live/vi-vn/%3A5919:4032
p3bet.live/vi-vn/%3A5919:4874
p3bet.live/vi-vn/%3A5919:6618
p3bet.live/vi-vn/%3A5534:6962
p3bet.live/vi-vn/%3A5534:7287
p3bet.live/vi-vn/%3A5534:9425
p3bet.live/vi-vn/%3A5534:9965
p3bet.live/vi-vn/%3A5534:4032
p3bet.live/vi-vn/%3A5534:4874
p3bet.live/vi-vn/%3A5534:6618
p3bet.live/vi-vn/%3A1136:6962
p3bet.live/vi-vn/%3A1136:7287
p3bet.live/vi-vn/%3A1136:9425
p3bet.live/vi-vn/%3A1136:9965
p3bet.live/vi-vn/%3A1136:4032
p3bet.live/vi-vn/%3A1136:4874
p3bet.live/vi-vn/%3A1136:6618
p3bet.live/vi-vn/%3A7521:6962
p3bet.live/vi-vn/%3A7521:7287
p3bet.live/vi-vn/%3A7521:9425
p3bet.live/vi-vn/%3A7521:9965
p3bet.live/vi-vn/%3A7521:4032
p3bet.live/vi-vn/%3A7521:4874
p3bet.live/vi-vn/%3A7521:6618
p3bet.live/vi-vn/%3A3009:6962
p3bet.live/vi-vn/%3A3009:7287
p3bet.live/vi-vn/%3A3009:9425
p3bet.live/vi-vn/%3A3009:9965
p3bet.live/vi-vn/%3A3009:4032
p3bet.live/vi-vn/%3A3009:4874
p3bet.live/vi-vn/%3A3009:6618
p3bet.live/vi-vn/%3A2569:6962
p3bet.live/vi-vn/%3A2569:7287
p3bet.live/vi-vn/%3A2569:9425
p3bet.live/vi-vn/%3A2569:9965
p3bet.live/vi-vn/%3A2569:4032
p3bet.live/vi-vn/%3A2569:4874
p3bet.live/vi-vn/%3A2569:6618

Mutex

wnFPFDUhPceL

Attributes

delay
3
install
true
install_file
p3betlive.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39d3f449-fe5e-4e4f-98f0-6257683e136d.exe

File Explorer

39d3f449-fe5e-4e4f-98f0-6257683e136d.exe

.exe 46KB

39d3f449-fe5e-4e4f-98f0-6257683e136d.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8e5e2e343bae17b1a8f26bb0342fe56fac28b2bd593deb46be9763bb9f4ceceb
MD5 74fb409637fbc2d572d9b578114d1d2a
SHA1 b09f88b244bd52d6f08bdd166f8fcdf9dbc048b9
SHA512 ce401f15c4fa9326597dfe00180611e62d8ac7cfb003cca856962e2de0e91a27a1156345db6a922d0fd24f837188140ebce0b42fa38c5b0cfb94367f69407511
SSDEEP 768:Qak0CLeA7rxvFwJGEx8RbkPOavH1PIJIjbwRg47F0SFHSnEnb+SRCTTFmM5bGf+J:Qak0CJdRIbhIKb/4h1FynqM5bGf+J
TLSH
T106232B003BE98226F2BE9F749DF26245467AF2632603D64E1CC412D75613FC5DA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

39d3f449-fe5e-4e4f-98f0-6257683e136d.exe

mscoree

dotnet