asyncrat | 056df09da8ae880b179eb8d545e151a32eb0cda9d05657428efb7612fe753eec

Sharing

Copy URL Twitter E-mail

General

Target
056df09da8ae880b179eb8d545e151a32eb0cda9d05657428efb7612fe753eec
Size 45KB
Sample260907-sdvdqshe92
SHA256 056df09da8ae880b179eb8d545e151a32eb0cda9d05657428efb7612fe753eec
MD5 c0f250f755e793cdbb16fbd164642076
SHA1 56a240eb90db29bc988a560ab5ed9eacf83bb9da
SHA512 21b2788ff4e156559b61e7d7eae8c02eb04f3f910bd0330ef052ffbf6ee675bc4758c4572cb89d4409243564ddbc1d25109417834b1b45c9725014d70f32d771
SSDEEP 768:guKWgSJTwU6NkWUGnaSmo2qAsj0UwPOlehAPITpzjbWgX3i2u/5XXcBDZwx:guKWgSJTwRf28j0/OghlTp3bJXS2u5qY
TLSH
T179232A003BE8822BF2BE5FB89CF26145467AF6737603D6491CC451DB5623BC6CA426F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

phimmy18.com:80
phimmy18.com:22
phimmy18.com:8080
phimmy18.com:8880
phimmy18.com:2052
phimmy18.com:2082
phimmy18.com:2086
phimmy18.com:2095
phimmy18.com:443
phimmy18.com:2053
phimmy18.com:2083
phimmy18.com:2087
phimmy18.com:2096
phimmy18.com:8443
www.phimmy18.com:80
www.phimmy18.com:22
www.phimmy18.com:8080
www.phimmy18.com:8880
www.phimmy18.com:2052
www.phimmy18.com:2082
www.phimmy18.com:2086
www.phimmy18.com:2095
www.phimmy18.com:443
www.phimmy18.com:2053
www.phimmy18.com:2083
www.phimmy18.com:2087
www.phimmy18.com:2096
www.phimmy18.com:8443
fakeupdates.phimmy18.com:80
fakeupdates.phimmy18.com:22
fakeupdates.phimmy18.com:8080
fakeupdates.phimmy18.com:8880
fakeupdates.phimmy18.com:2052
fakeupdates.phimmy18.com:2082
fakeupdates.phimmy18.com:2086
fakeupdates.phimmy18.com:2095
fakeupdates.phimmy18.com:443
fakeupdates.phimmy18.com:2053
fakeupdates.phimmy18.com:2083
fakeupdates.phimmy18.com:2087
fakeupdates.phimmy18.com:2096
fakeupdates.phimmy18.com:8443
shamoon.phimmy18.com:80
shamoon.phimmy18.com:22
shamoon.phimmy18.com:8080
shamoon.phimmy18.com:8880
shamoon.phimmy18.com:2052
shamoon.phimmy18.com:2082
shamoon.phimmy18.com:2086
shamoon.phimmy18.com:2095
shamoon.phimmy18.com:443
shamoon.phimmy18.com:2053
shamoon.phimmy18.com:2083
shamoon.phimmy18.com:2087
shamoon.phimmy18.com:2096
shamoon.phimmy18.com:8443
notpetya.phimmy18.com:80
notpetya.phimmy18.com:22
notpetya.phimmy18.com:8080
notpetya.phimmy18.com:8880
notpetya.phimmy18.com:2052
notpetya.phimmy18.com:2082
notpetya.phimmy18.com:2086
notpetya.phimmy18.com:2095
notpetya.phimmy18.com:443
notpetya.phimmy18.com:2053
notpetya.phimmy18.com:2083
notpetya.phimmy18.com:2087
notpetya.phimmy18.com:2096
notpetya.phimmy18.com:8443
gh0st.phimmy18.com:80
gh0st.phimmy18.com:22
gh0st.phimmy18.com:8080
gh0st.phimmy18.com:8880
gh0st.phimmy18.com:2052
gh0st.phimmy18.com:2082
gh0st.phimmy18.com:2086
gh0st.phimmy18.com:2095
gh0st.phimmy18.com:443
gh0st.phimmy18.com:2053
gh0st.phimmy18.com:2083
gh0st.phimmy18.com:2087
gh0st.phimmy18.com:2096
gh0st.phimmy18.com:8443

Mutex

85hNx5A1doct

Attributes

delay
0
install
true
install_file
lqqeoksv.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
056df09da8ae880b179eb8d545e151a32eb0cda9d05657428efb7612fe753eec

File Explorer

056df09da8ae880b179eb8d545e151a32eb0cda9d05657428efb7612fe753eec

.exe 45KB

056df09da8ae880b179eb8d545e151a32eb0cda9d05657428efb7612fe753eec

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 056df09da8ae880b179eb8d545e151a32eb0cda9d05657428efb7612fe753eec
MD5 c0f250f755e793cdbb16fbd164642076
SHA1 56a240eb90db29bc988a560ab5ed9eacf83bb9da
SHA512 21b2788ff4e156559b61e7d7eae8c02eb04f3f910bd0330ef052ffbf6ee675bc4758c4572cb89d4409243564ddbc1d25109417834b1b45c9725014d70f32d771
SSDEEP 768:guKWgSJTwU6NkWUGnaSmo2qAsj0UwPOlehAPITpzjbWgX3i2u/5XXcBDZwx:guKWgSJTwRf28j0/OghlTp3bJXS2u5qY
TLSH
T179232A003BE8822BF2BE5FB89CF26145467AF6737603D6491CC451DB5623BC6CA426F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

056df09da8ae880b179eb8d545e151a32eb0cda9d05657428efb7612fe753eec

mscoree

dotnet