asyncrat | ditnatlon[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ditnatlon.exe
Size 48KB
Sample260809-r5csbszele
SHA256 baa98f6bde7c9b60bc0d67baac00ee5969e254be7b9bdaebcd760e0e2bd35aee
MD5 1681fd6a2d44b629070824a88f859f7b
SHA1 8f615ca1c810045e6c27db7ccfa4cfc5a29cbdf4
SHA512 276c19b54bfaecaff085706bacef786b317f187c9954170a87f3314c7a3ebe6d5f2f5cb1044ddf183e648eaa1e52eb39a721e47af232b678649e123104c3d18b
SSDEEP 768:Fudk+TA0g9fsqtWUZt9Lmo2qxiy6Hjc/rXYYbPIZ2Sf/p3d0b6ZM9vOkL+ISYun6:Fudk+TARz2Z4rXYvZ2Sf/pKb6Z0vOkF/
TLSH
T10D231B003BE9813AF2BE4F74A9F271458677F2637606D64E1CC4429B5613BC2CA425FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

j8jy8.co/vi-vn/:6606
j8jy8.co/vi-vn/:80
j8jy8.co/vi-vn/:8080
j8jy8.co/vi-vn/:443
j8jy8.co/vi-vn/:8443
j8jy8.co/vi-vn/:22
j8jy8.co/vi-vn/:23
8jok.pw/vi-vn/:6606
8jok.pw/vi-vn/:80
8jok.pw/vi-vn/:8080
8jok.pw/vi-vn/:443
8jok.pw/vi-vn/:8443
8jok.pw/vi-vn/:22
8jok.pw/vi-vn/:23
789win.proficientbookpublishers.co/vn/:6606
789win.proficientbookpublishers.co/vn/:80
789win.proficientbookpublishers.co/vn/:8080
789win.proficientbookpublishers.co/vn/:443
789win.proficientbookpublishers.co/vn/:8443
789win.proficientbookpublishers.co/vn/:22
789win.proficientbookpublishers.co/vn/:23
proficientbookpublishers.co/vn/:6606
proficientbookpublishers.co/vn/:80
proficientbookpublishers.co/vn/:8080
proficientbookpublishers.co/vn/:443
proficientbookpublishers.co/vn/:8443
proficientbookpublishers.co/vn/:22
proficientbookpublishers.co/vn/:23
789winbett.pro/vi-vn/:6606
789winbett.pro/vi-vn/:80
789winbett.pro/vi-vn/:8080
789winbett.pro/vi-vn/:443
789winbett.pro/vi-vn/:8443
789winbett.pro/vi-vn/:22
789winbett.pro/vi-vn/:23
riobet-www.top/vi-vn/:6606
riobet-www.top/vi-vn/:80
riobet-www.top/vi-vn/:8080
riobet-www.top/vi-vn/:443
riobet-www.top/vi-vn/:8443
riobet-www.top/vi-vn/:22
riobet-www.top/vi-vn/:23
riobet-top.top/vi-vn/:6606
riobet-top.top/vi-vn/:80
riobet-top.top/vi-vn/:8080
riobet-top.top/vi-vn/:443
riobet-top.top/vi-vn/:8443
riobet-top.top/vi-vn/:22
riobet-top.top/vi-vn/:23
sherari.nl/vi-vn/:6606
sherari.nl/vi-vn/:80
sherari.nl/vi-vn/:8080
sherari.nl/vi-vn/:443
sherari.nl/vi-vn/:8443
sherari.nl/vi-vn/:22
sherari.nl/vi-vn/:23
pdmt.in/vi-vn/:6606
pdmt.in/vi-vn/:80
pdmt.in/vi-vn/:8080
pdmt.in/vi-vn/:443
pdmt.in/vi-vn/:8443
pdmt.in/vi-vn/:22
pdmt.in/vi-vn/:23
01cb01.me/vi-vn/:6606
01cb01.me/vi-vn/:80
01cb01.me/vi-vn/:8080
01cb01.me/vi-vn/:443
01cb01.me/vi-vn/:8443
01cb01.me/vi-vn/:22
01cb01.me/vi-vn/:23
nk88.royalgroupofcompanies.in/vn/:6606
nk88.royalgroupofcompanies.in/vn/:80
nk88.royalgroupofcompanies.in/vn/:8080
nk88.royalgroupofcompanies.in/vn/:443
nk88.royalgroupofcompanies.in/vn/:8443
nk88.royalgroupofcompanies.in/vn/:22
nk88.royalgroupofcompanies.in/vn/:23
royalgroupofcompanies.in/vn/:6606
royalgroupofcompanies.in/vn/:80
royalgroupofcompanies.in/vn/:8080
royalgroupofcompanies.in/vn/:443
royalgroupofcompanies.in/vn/:8443
royalgroupofcompanies.in/vn/:22
royalgroupofcompanies.in/vn/:23

Mutex

aLhzGntEuq91

Attributes

delay
3
install
true
install_file
GoogleUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ditnatlon.exe

File Explorer

ditnatlon.exe

.exe 48KB

ditnatlon.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 baa98f6bde7c9b60bc0d67baac00ee5969e254be7b9bdaebcd760e0e2bd35aee
MD5 1681fd6a2d44b629070824a88f859f7b
SHA1 8f615ca1c810045e6c27db7ccfa4cfc5a29cbdf4
SHA512 276c19b54bfaecaff085706bacef786b317f187c9954170a87f3314c7a3ebe6d5f2f5cb1044ddf183e648eaa1e52eb39a721e47af232b678649e123104c3d18b
SSDEEP 768:Fudk+TA0g9fsqtWUZt9Lmo2qxiy6Hjc/rXYYbPIZ2Sf/p3d0b6ZM9vOkL+ISYun6:Fudk+TARz2Z4rXYvZ2Sf/pKb6Z0vOkF/
TLSH
T10D231B003BE9813AF2BE4F74A9F271458677F2637606D64E1CC4429B5613BC2CA425FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54110

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ditnatlon.exe

mscoree

dotnet