asyncrat | mm3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mm3.exe
Size 49KB
Sample260810-fb1rhs1eqa
SHA256 f598eee2a15151d6341d59da1bda7d596392ee1bd7387175dc173a594ecd591b
MD5 ad9f9bfb07785c65ec892a64d22cd133
SHA1 b5fcf33407e1b86735780163504dbecc5db9ab34
SHA512 e79d92485c901db554f4cd84ae973da5d4ea0298d6ec5ddbdb4a1b4639d39a531e1169e1c57d2e2f563f2185d66e9284a408740efe7d07b244add6376d5f8ddb
SSDEEP 768:euCjsT8ktqGWUg9P0mo2q7XNRPNGRaKPINOHUVw20bsoWKP7hjHA1uElPP/AfBDP:euCjsT8Kn2Y6osjZbsob76flPHYdc6
TLSH
T185333B043BEDC12AF2BE4F749DF2224685BBF5637603D64E1CC411964A23FC29A526F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

789win.proficientbookpublishers.co/vn/:6606
789win.proficientbookpublishers.co/vn/:80
789win.proficientbookpublishers.co/vn/:8080
789win.proficientbookpublishers.co/vn/:443
789win.proficientbookpublishers.co/vn/:8443
789win.proficientbookpublishers.co/vn/:22
789win.proficientbookpublishers.co/vn/:23
proficientbookpublishers.co/vn/:6606
proficientbookpublishers.co/vn/:80
proficientbookpublishers.co/vn/:8080
proficientbookpublishers.co/vn/:443
proficientbookpublishers.co/vn/:8443
proficientbookpublishers.co/vn/:22
proficientbookpublishers.co/vn/:23
pdmt.in/vi-vn/:6606
pdmt.in/vi-vn/:80
pdmt.in/vi-vn/:8080
pdmt.in/vi-vn/:443
pdmt.in/vi-vn/:8443
pdmt.in/vi-vn/:22
pdmt.in/vi-vn/:23
twofyw.me/vi-vn/:6606
twofyw.me/vi-vn/:80
twofyw.me/vi-vn/:8080
twofyw.me/vi-vn/:443
twofyw.me/vi-vn/:8443
twofyw.me/vi-vn/:22
twofyw.me/vi-vn/:23
pgslot789win.co/vi-vn/:6606
pgslot789win.co/vi-vn/:80
pgslot789win.co/vi-vn/:8080
pgslot789win.co/vi-vn/:443
pgslot789win.co/vi-vn/:8443
pgslot789win.co/vi-vn/:22
pgslot789win.co/vi-vn/:23
789winclub.lol/vi-vn/:6606
789winclub.lol/vi-vn/:80
789winclub.lol/vi-vn/:8080
789winclub.lol/vi-vn/:443
789winclub.lol/vi-vn/:8443
789winclub.lol/vi-vn/:22
789winclub.lol/vi-vn/:23
tipspoker.co/vi-vn/:6606
tipspoker.co/vi-vn/:80
tipspoker.co/vi-vn/:8080
tipspoker.co/vi-vn/:443
tipspoker.co/vi-vn/:8443
tipspoker.co/vi-vn/:22
tipspoker.co/vi-vn/:23
hemaskitchen.in/vi-vn/:6606
hemaskitchen.in/vi-vn/:80
hemaskitchen.in/vi-vn/:8080
hemaskitchen.in/vi-vn/:443
hemaskitchen.in/vi-vn/:8443
hemaskitchen.in/vi-vn/:22
hemaskitchen.in/vi-vn/:23
outsetplymouth.co.uk/vi-vn/:6606
outsetplymouth.co.uk/vi-vn/:80
outsetplymouth.co.uk/vi-vn/:8080
outsetplymouth.co.uk/vi-vn/:443
outsetplymouth.co.uk/vi-vn/:8443
outsetplymouth.co.uk/vi-vn/:22
outsetplymouth.co.uk/vi-vn/:23
theboxco.com.co/vi-vn/:6606
theboxco.com.co/vi-vn/:80
theboxco.com.co/vi-vn/:8080
theboxco.com.co/vi-vn/:443
theboxco.com.co/vi-vn/:8443
theboxco.com.co/vi-vn/:22
theboxco.com.co/vi-vn/:23
3y6y8.buzz/vi-vn/:6606
3y6y8.buzz/vi-vn/:80
3y6y8.buzz/vi-vn/:8080
3y6y8.buzz/vi-vn/:443
3y6y8.buzz/vi-vn/:8443
3y6y8.buzz/vi-vn/:22
3y6y8.buzz/vi-vn/:23
turegaloya.com.co/vi-vn/:6606
turegaloya.com.co/vi-vn/:80
turegaloya.com.co/vi-vn/:8080
turegaloya.com.co/vi-vn/:443
turegaloya.com.co/vi-vn/:8443
turegaloya.com.co/vi-vn/:22
turegaloya.com.co/vi-vn/:23
vipmandiriqq.poker/vi-vn/:6606
vipmandiriqq.poker/vi-vn/:80
vipmandiriqq.poker/vi-vn/:8080
vipmandiriqq.poker/vi-vn/:443
vipmandiriqq.poker/vi-vn/:8443
vipmandiriqq.poker/vi-vn/:22
vipmandiriqq.poker/vi-vn/:23
hashlucky777.io/vi-vn/:6606
hashlucky777.io/vi-vn/:80
hashlucky777.io/vi-vn/:8080
hashlucky777.io/vi-vn/:443
hashlucky777.io/vi-vn/:8443
hashlucky777.io/vi-vn/:22
hashlucky777.io/vi-vn/:23
riobet-vip.website/vi-vn/:6606
riobet-vip.website/vi-vn/:80
riobet-vip.website/vi-vn/:8080
riobet-vip.website/vi-vn/:443
riobet-vip.website/vi-vn/:8443
riobet-vip.website/vi-vn/:22
riobet-vip.website/vi-vn/:23
movies4u.marketing/vn/:6606
movies4u.marketing/vn/:80
movies4u.marketing/vn/:8080
movies4u.marketing/vn/:443
movies4u.marketing/vn/:8443
movies4u.marketing/vn/:22
movies4u.marketing/vn/:23

Mutex

uBM5NBapodbH

Attributes

delay
3
install
true
install_file
GoogleUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mm3.exe

File Explorer

mm3.exe

.exe 49KB

mm3.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f598eee2a15151d6341d59da1bda7d596392ee1bd7387175dc173a594ecd591b
MD5 ad9f9bfb07785c65ec892a64d22cd133
SHA1 b5fcf33407e1b86735780163504dbecc5db9ab34
SHA512 e79d92485c901db554f4cd84ae973da5d4ea0298d6ec5ddbdb4a1b4639d39a531e1169e1c57d2e2f563f2185d66e9284a408740efe7d07b244add6376d5f8ddb
SSDEEP 768:euCjsT8ktqGWUg9P0mo2q7XNRPNGRaKPINOHUVw20bsoWKP7hjHA1uElPP/AfBDP:euCjsT8Kn2Y6osjZbsob76flPHYdc6
TLSH
T185333B043BEDC12AF2BE4F749DF2224685BBF5637603D64E1CC411964A23FC29A526F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mm3.exe

mscoree

dotnet