asyncrat | fcf00df0a7bc707764ed3a987e951c74f56f91cac4197df2870c916a014d96a3

Sharing

Copy URL Twitter E-mail

General

Target
fcf00df0a7bc707764ed3a987e951c74f56f91cac4197df2870c916a014d96a3
Size 45KB
Sample260905-pr7pfa1yev
SHA256 fcf00df0a7bc707764ed3a987e951c74f56f91cac4197df2870c916a014d96a3
MD5 bec7de921a7f225b773968d97fdd674a
SHA1 04cfb4437915af69fe917a52939235fa6d1cc4ca
SHA512 69c6e7fbcdafc40c244de4e11baef7d9f3a16f93b3b361327e454295d142108126070baa387f709c308908db3cb41cb26b1610312c2235f28b24a79a6d1d31c2
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7jZoyTM4PIXLjbegX3i2TOIK3GGwBDZ8x:0ushJTDXgH26h0XfbhXS22yd8x
TLSH
T19C232B003BE8812BF2BE5F78A9F26105867AF5637603D58E1CC4419B5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

top-sexviet.blog:80
top-sexviet.blog:22
top-sexviet.blog:8080
top-sexviet.blog:8880
top-sexviet.blog:2052
top-sexviet.blog:2082
top-sexviet.blog:2086
top-sexviet.blog:2095
top-sexviet.blog:443
top-sexviet.blog:2053
top-sexviet.blog:2083
top-sexviet.blog:2087
top-sexviet.blog:2096
top-sexviet.blog:8443
www.top-sexviet.blog:80
www.top-sexviet.blog:22
www.top-sexviet.blog:8080
www.top-sexviet.blog:8880
www.top-sexviet.blog:2052
www.top-sexviet.blog:2082
www.top-sexviet.blog:2086
www.top-sexviet.blog:2095
www.top-sexviet.blog:443
www.top-sexviet.blog:2053
www.top-sexviet.blog:2083
www.top-sexviet.blog:2087
www.top-sexviet.blog:2096
www.top-sexviet.blog:8443
cryptolocker.top-sexviet.blog:80
cryptolocker.top-sexviet.blog:22
cryptolocker.top-sexviet.blog:8080
cryptolocker.top-sexviet.blog:8880
cryptolocker.top-sexviet.blog:2052
cryptolocker.top-sexviet.blog:2082
cryptolocker.top-sexviet.blog:2086
cryptolocker.top-sexviet.blog:2095
cryptolocker.top-sexviet.blog:443
cryptolocker.top-sexviet.blog:2053
cryptolocker.top-sexviet.blog:2083
cryptolocker.top-sexviet.blog:2087
cryptolocker.top-sexviet.blog:2096
cryptolocker.top-sexviet.blog:8443
connect.top-sexviet.blog:80
connect.top-sexviet.blog:22
connect.top-sexviet.blog:8080
connect.top-sexviet.blog:8880
connect.top-sexviet.blog:2052
connect.top-sexviet.blog:2082
connect.top-sexviet.blog:2086
connect.top-sexviet.blog:2095
connect.top-sexviet.blog:443
connect.top-sexviet.blog:2053
connect.top-sexviet.blog:2083
connect.top-sexviet.blog:2087
connect.top-sexviet.blog:2096
connect.top-sexviet.blog:8443
klez.top-sexviet.blog:80
klez.top-sexviet.blog:22
klez.top-sexviet.blog:8080
klez.top-sexviet.blog:8880
klez.top-sexviet.blog:2052
klez.top-sexviet.blog:2082
klez.top-sexviet.blog:2086
klez.top-sexviet.blog:2095
klez.top-sexviet.blog:443
klez.top-sexviet.blog:2053
klez.top-sexviet.blog:2083
klez.top-sexviet.blog:2087
klez.top-sexviet.blog:2096
klez.top-sexviet.blog:8443
locky.top-sexviet.blog:80
locky.top-sexviet.blog:22
locky.top-sexviet.blog:8080
locky.top-sexviet.blog:8880
locky.top-sexviet.blog:2052
locky.top-sexviet.blog:2082
locky.top-sexviet.blog:2086
locky.top-sexviet.blog:2095
locky.top-sexviet.blog:443
locky.top-sexviet.blog:2053
locky.top-sexviet.blog:2083
locky.top-sexviet.blog:2087
locky.top-sexviet.blog:2096
locky.top-sexviet.blog:8443

Mutex

KQY1GFy1CrQ9

Attributes

delay
0
install
true
install_file
ltml8a.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fcf00df0a7bc707764ed3a987e951c74f56f91cac4197df2870c916a014d96a3

File Explorer

fcf00df0a7bc707764ed3a987e951c74f56f91cac4197df2870c916a014d96a3

.exe 45KB

fcf00df0a7bc707764ed3a987e951c74f56f91cac4197df2870c916a014d96a3

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fcf00df0a7bc707764ed3a987e951c74f56f91cac4197df2870c916a014d96a3
MD5 bec7de921a7f225b773968d97fdd674a
SHA1 04cfb4437915af69fe917a52939235fa6d1cc4ca
SHA512 69c6e7fbcdafc40c244de4e11baef7d9f3a16f93b3b361327e454295d142108126070baa387f709c308908db3cb41cb26b1610312c2235f28b24a79a6d1d31c2
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7jZoyTM4PIXLjbegX3i2TOIK3GGwBDZ8x:0ushJTDXgH26h0XfbhXS22yd8x
TLSH
T19C232B003BE8812BF2BE5F78A9F26105867AF5637603D58E1CC4419B5723FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

fcf00df0a7bc707764ed3a987e951c74f56f91cac4197df2870c916a014d96a3

mscoree

dotnet