asyncrat | 0cffa58e15617cf0af06fbd95dab1fc0bd4c5da1243af351df25379928f554f6

Sharing

Copy URL Twitter E-mail

General

Target
0cffa58e15617cf0af06fbd95dab1fc0bd4c5da1243af351df25379928f554f6
Size 45KB
Sample260919-rex1ksstdt
SHA256 0cffa58e15617cf0af06fbd95dab1fc0bd4c5da1243af351df25379928f554f6
MD5 083a1b22a416a7ee8807ce3c6aacf4e5
SHA1 930d63e2a4b7ccca9ca3afd5b480ce11246fa2b0
SHA512 c6108e4b503b7b3c52d0879ea5f71f9a5783242eb670b9f08d299fbf498a00705b9de915d6ec20c4f15d281e151e34c1443464adb1f857a4d60d99a126717734
SSDEEP 768:guKWgSJTwU6NkWUGnaSmo2qAsj0UwPOlehAPITpzjbJgX3iyOQYhk7mHh4STlafC:guKWgSJTwRf28j0/OghlTp3bGXS9Hh46
TLSH
T1A4232A003BE8813BF2BE5F7899F22145867AF2637603D64D1CC451DB5A23FC69A426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

vnsextop1.com:80
vnsextop1.com:22
vnsextop1.com:8080
vnsextop1.com:8880
vnsextop1.com:2052
vnsextop1.com:2082
vnsextop1.com:2086
vnsextop1.com:2095
vnsextop1.com:443
vnsextop1.com:2053
vnsextop1.com:2083
vnsextop1.com:2087
vnsextop1.com:2096
vnsextop1.com:8443
www.vnsextop1.com:80
www.vnsextop1.com:22
www.vnsextop1.com:8080
www.vnsextop1.com:8880
www.vnsextop1.com:2052
www.vnsextop1.com:2082
www.vnsextop1.com:2086
www.vnsextop1.com:2095
www.vnsextop1.com:443
www.vnsextop1.com:2053
www.vnsextop1.com:2083
www.vnsextop1.com:2087
www.vnsextop1.com:2096
www.vnsextop1.com:8443
remcos.vnsextop1.com:80
remcos.vnsextop1.com:22
remcos.vnsextop1.com:8080
remcos.vnsextop1.com:8880
remcos.vnsextop1.com:2052
remcos.vnsextop1.com:2082
remcos.vnsextop1.com:2086
remcos.vnsextop1.com:2095
remcos.vnsextop1.com:443
remcos.vnsextop1.com:2053
remcos.vnsextop1.com:2083
remcos.vnsextop1.com:2087
remcos.vnsextop1.com:2096
remcos.vnsextop1.com:8443
qbot.vnsextop1.com:80
qbot.vnsextop1.com:22
qbot.vnsextop1.com:8080
qbot.vnsextop1.com:8880
qbot.vnsextop1.com:2052
qbot.vnsextop1.com:2082
qbot.vnsextop1.com:2086
qbot.vnsextop1.com:2095
qbot.vnsextop1.com:443
qbot.vnsextop1.com:2053
qbot.vnsextop1.com:2083
qbot.vnsextop1.com:2087
qbot.vnsextop1.com:2096
qbot.vnsextop1.com:8443
emotet.vnsextop1.com:80
emotet.vnsextop1.com:22
emotet.vnsextop1.com:8080
emotet.vnsextop1.com:8880
emotet.vnsextop1.com:2052
emotet.vnsextop1.com:2082
emotet.vnsextop1.com:2086
emotet.vnsextop1.com:2095
emotet.vnsextop1.com:443
emotet.vnsextop1.com:2053
emotet.vnsextop1.com:2083
emotet.vnsextop1.com:2087
emotet.vnsextop1.com:2096
emotet.vnsextop1.com:8443
shamoon.vnsextop1.com:80
shamoon.vnsextop1.com:22
shamoon.vnsextop1.com:8080
shamoon.vnsextop1.com:8880
shamoon.vnsextop1.com:2052
shamoon.vnsextop1.com:2082
shamoon.vnsextop1.com:2086
shamoon.vnsextop1.com:2095
shamoon.vnsextop1.com:443
shamoon.vnsextop1.com:2053
shamoon.vnsextop1.com:2083
shamoon.vnsextop1.com:2087
shamoon.vnsextop1.com:2096
shamoon.vnsextop1.com:8443

Mutex

FELvJ4XlnJTk

Attributes

delay
0
install
true
install_file
1elh2khv.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0cffa58e15617cf0af06fbd95dab1fc0bd4c5da1243af351df25379928f554f6

File Explorer

0cffa58e15617cf0af06fbd95dab1fc0bd4c5da1243af351df25379928f554f6

.exe 45KB

0cffa58e15617cf0af06fbd95dab1fc0bd4c5da1243af351df25379928f554f6

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0cffa58e15617cf0af06fbd95dab1fc0bd4c5da1243af351df25379928f554f6
MD5 083a1b22a416a7ee8807ce3c6aacf4e5
SHA1 930d63e2a4b7ccca9ca3afd5b480ce11246fa2b0
SHA512 c6108e4b503b7b3c52d0879ea5f71f9a5783242eb670b9f08d299fbf498a00705b9de915d6ec20c4f15d281e151e34c1443464adb1f857a4d60d99a126717734
SSDEEP 768:guKWgSJTwU6NkWUGnaSmo2qAsj0UwPOlehAPITpzjbJgX3iyOQYhk7mHh4STlafC:guKWgSJTwRf28j0/OghlTp3bGXS9Hh46
TLSH
T1A4232A003BE8813BF2BE5F7899F22145867AF2637603D64D1CC451DB5A23FC69A426ED
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

0cffa58e15617cf0af06fbd95dab1fc0bd4c5da1243af351df25379928f554f6

mscoree

dotnet