asyncrat | f2fb023be95645571989f38e73b116ed19b669c7c31bdb6ac6148ff41c8cb842

Sharing

Copy URL Twitter E-mail

General

Target
f2fb023be95645571989f38e73b116ed19b669c7c31bdb6ac6148ff41c8cb842
Size 46KB
Sample260808-yjn2sstdnh
SHA256 f2fb023be95645571989f38e73b116ed19b669c7c31bdb6ac6148ff41c8cb842
MD5 cb50e03da10e245659c2c1075a866964
SHA1 83ab52d91ce52b2c4feb67f8603ed50c6bedcbd5
SHA512 ce069f6f9577536dc4321afbcf48b488a0f9b9992cad38798b220ad27e271b44fe3333e7022ef34f85326e178562253782797cd012c9ce71b2109887ded2af0a
SSDEEP 768:4acFSdLZK3HUxv0wruGkx8cIuG0P6rd1P1JIjbqg47bBQheavuYKmM5b+f+h:4acFcV+EbYlUn1Kb94/itjLM5b+f+h
TLSH
T150232C003BEDC22BF1BE5F7899F2624546B5F6633603D98E1C8412D65613FC6CA426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

pg55.fit:4441
pg55.fit:1756
pg55.fit:1250
pg55.fit:5126
pg55.fit:4738
pg55.fit:7097
pg55.fit:8235
www.pg55.fit:4441
www.pg55.fit:1756
www.pg55.fit:1250
www.pg55.fit:5126
www.pg55.fit:4738
www.pg55.fit:7097
www.pg55.fit:8235
NotPetya.pg55.fit:4441
NotPetya.pg55.fit:1756
NotPetya.pg55.fit:1250
NotPetya.pg55.fit:5126
NotPetya.pg55.fit:4738
NotPetya.pg55.fit:7097
NotPetya.pg55.fit:8235
Stuxnet.pg55.fit:4441
Stuxnet.pg55.fit:1756
Stuxnet.pg55.fit:1250
Stuxnet.pg55.fit:5126
Stuxnet.pg55.fit:4738
Stuxnet.pg55.fit:7097
Stuxnet.pg55.fit:8235
Zeus.pg55.fit:4441
Zeus.pg55.fit:1756
Zeus.pg55.fit:1250
Zeus.pg55.fit:5126
Zeus.pg55.fit:4738
Zeus.pg55.fit:7097
Zeus.pg55.fit:8235
CryptoLocker.pg55.fit:4441
CryptoLocker.pg55.fit:1756
CryptoLocker.pg55.fit:1250
CryptoLocker.pg55.fit:5126
CryptoLocker.pg55.fit:4738
CryptoLocker.pg55.fit:7097
CryptoLocker.pg55.fit:8235
pg55.fit/vi-vn/%3A4915:4441
pg55.fit/vi-vn/%3A4915:1756
pg55.fit/vi-vn/%3A4915:1250
pg55.fit/vi-vn/%3A4915:5126
pg55.fit/vi-vn/%3A4915:4738
pg55.fit/vi-vn/%3A4915:7097
pg55.fit/vi-vn/%3A4915:8235
pg55.fit/vi-vn/%3A4004:4441
pg55.fit/vi-vn/%3A4004:1756
pg55.fit/vi-vn/%3A4004:1250
pg55.fit/vi-vn/%3A4004:5126
pg55.fit/vi-vn/%3A4004:4738
pg55.fit/vi-vn/%3A4004:7097
pg55.fit/vi-vn/%3A4004:8235
pg55.fit/vi-vn/%3A0227:4441
pg55.fit/vi-vn/%3A0227:1756
pg55.fit/vi-vn/%3A0227:1250
pg55.fit/vi-vn/%3A0227:5126
pg55.fit/vi-vn/%3A0227:4738
pg55.fit/vi-vn/%3A0227:7097
pg55.fit/vi-vn/%3A0227:8235
pg55.fit/vi-vn/%3A4015:4441
pg55.fit/vi-vn/%3A4015:1756
pg55.fit/vi-vn/%3A4015:1250
pg55.fit/vi-vn/%3A4015:5126
pg55.fit/vi-vn/%3A4015:4738
pg55.fit/vi-vn/%3A4015:7097
pg55.fit/vi-vn/%3A4015:8235
pg55.fit/vi-vn/%3A3057:4441
pg55.fit/vi-vn/%3A3057:1756
pg55.fit/vi-vn/%3A3057:1250
pg55.fit/vi-vn/%3A3057:5126
pg55.fit/vi-vn/%3A3057:4738
pg55.fit/vi-vn/%3A3057:7097
pg55.fit/vi-vn/%3A3057:8235
pg55.fit/vi-vn/%3A3211:4441
pg55.fit/vi-vn/%3A3211:1756
pg55.fit/vi-vn/%3A3211:1250
pg55.fit/vi-vn/%3A3211:5126
pg55.fit/vi-vn/%3A3211:4738
pg55.fit/vi-vn/%3A3211:7097
pg55.fit/vi-vn/%3A3211:8235
pg55.fit/vi-vn/%3A0903:4441
pg55.fit/vi-vn/%3A0903:1756
pg55.fit/vi-vn/%3A0903:1250
pg55.fit/vi-vn/%3A0903:5126
pg55.fit/vi-vn/%3A0903:4738
pg55.fit/vi-vn/%3A0903:7097
pg55.fit/vi-vn/%3A0903:8235

Mutex

J2G0ospPyyF1

Attributes

delay
3
install
true
install_file
pg55fit.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2fb023be95645571989f38e73b116ed19b669c7c31bdb6ac6148ff41c8cb842

File Explorer

f2fb023be95645571989f38e73b116ed19b669c7c31bdb6ac6148ff41c8cb842

.exe 46KB

f2fb023be95645571989f38e73b116ed19b669c7c31bdb6ac6148ff41c8cb842

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f2fb023be95645571989f38e73b116ed19b669c7c31bdb6ac6148ff41c8cb842
MD5 cb50e03da10e245659c2c1075a866964
SHA1 83ab52d91ce52b2c4feb67f8603ed50c6bedcbd5
SHA512 ce069f6f9577536dc4321afbcf48b488a0f9b9992cad38798b220ad27e271b44fe3333e7022ef34f85326e178562253782797cd012c9ce71b2109887ded2af0a
SSDEEP 768:4acFSdLZK3HUxv0wruGkx8cIuG0P6rd1P1JIjbqg47bBQheavuYKmM5b+f+h:4acFcV+EbYlUn1Kb94/itjLM5b+f+h
TLSH
T150232C003BEDC22BF1BE5F7899F2624546B5F6633603D98E1C8412D65613FC6CA426FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f2fb023be95645571989f38e73b116ed19b669c7c31bdb6ac6148ff41c8cb842

mscoree

dotnet