asyncrat | a42ef04075743b214539bbfae0b931fbf840087ecb50891053a718c38f81f334

Sharing

Copy URL Twitter E-mail

General

Target
a42ef04075743b214539bbfae0b931fbf840087ecb50891053a718c38f81f334
Size 45KB
Sample260907-rbq3vsbj5x
SHA256 a42ef04075743b214539bbfae0b931fbf840087ecb50891053a718c38f81f334
MD5 a32bee348c80e87bdeda98a980841aee
SHA1 262f5950506204c31be0b5f77115d89d8cd0d576
SHA512 29e8ac9f66f3fbd684f790dd40fa78c4fc2942460b3deebeb2abfe7fe8fde5880c487c9e18b2fe433adcbf3a72f60bfa1a5455e55421509c2bebf4a944547582
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q19/D0CCMAR4np78PIcEjbdgX3iJwvQS3xhqfBDZUx:cuR0JTPjY2kTCzwBcEbKXSJYQWidUx
TLSH
T14B232B0037E8812BF2BE4B786DF26245867BF6732502D54A1CC451DB5A23FC69A436FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimheovn.com:80
phimheovn.com:22
phimheovn.com:8080
phimheovn.com:8880
phimheovn.com:2052
phimheovn.com:2082
phimheovn.com:2086
phimheovn.com:2095
phimheovn.com:443
phimheovn.com:2053
phimheovn.com:2083
phimheovn.com:2087
phimheovn.com:2096
phimheovn.com:8443
www.phimheovn.com:80
www.phimheovn.com:22
www.phimheovn.com:8080
www.phimheovn.com:8880
www.phimheovn.com:2052
www.phimheovn.com:2082
www.phimheovn.com:2086
www.phimheovn.com:2095
www.phimheovn.com:443
www.phimheovn.com:2053
www.phimheovn.com:2083
www.phimheovn.com:2087
www.phimheovn.com:2096
www.phimheovn.com:8443
notpetya.phimheovn.com:80
notpetya.phimheovn.com:22
notpetya.phimheovn.com:8080
notpetya.phimheovn.com:8880
notpetya.phimheovn.com:2052
notpetya.phimheovn.com:2082
notpetya.phimheovn.com:2086
notpetya.phimheovn.com:2095
notpetya.phimheovn.com:443
notpetya.phimheovn.com:2053
notpetya.phimheovn.com:2083
notpetya.phimheovn.com:2087
notpetya.phimheovn.com:2096
notpetya.phimheovn.com:8443
fakeupdates.phimheovn.com:80
fakeupdates.phimheovn.com:22
fakeupdates.phimheovn.com:8080
fakeupdates.phimheovn.com:8880
fakeupdates.phimheovn.com:2052
fakeupdates.phimheovn.com:2082
fakeupdates.phimheovn.com:2086
fakeupdates.phimheovn.com:2095
fakeupdates.phimheovn.com:443
fakeupdates.phimheovn.com:2053
fakeupdates.phimheovn.com:2083
fakeupdates.phimheovn.com:2087
fakeupdates.phimheovn.com:2096
fakeupdates.phimheovn.com:8443

Mutex

tEVe5q28rB7j

Attributes

delay
0
install
true
install_file
9jhd.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a42ef04075743b214539bbfae0b931fbf840087ecb50891053a718c38f81f334

File Explorer

a42ef04075743b214539bbfae0b931fbf840087ecb50891053a718c38f81f334

.exe 45KB

a42ef04075743b214539bbfae0b931fbf840087ecb50891053a718c38f81f334

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a42ef04075743b214539bbfae0b931fbf840087ecb50891053a718c38f81f334
MD5 a32bee348c80e87bdeda98a980841aee
SHA1 262f5950506204c31be0b5f77115d89d8cd0d576
SHA512 29e8ac9f66f3fbd684f790dd40fa78c4fc2942460b3deebeb2abfe7fe8fde5880c487c9e18b2fe433adcbf3a72f60bfa1a5455e55421509c2bebf4a944547582
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q19/D0CCMAR4np78PIcEjbdgX3iJwvQS3xhqfBDZUx:cuR0JTPjY2kTCzwBcEbKXSJYQWidUx
TLSH
T14B232B0037E8812BF2BE4B786DF26245867BF6732502D54A1CC451DB5A23FC69A436FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

a42ef04075743b214539bbfae0b931fbf840087ecb50891053a718c38f81f334

mscoree

dotnet