asyncrat | b7f4e119aed42d03af852c3f1f2ba71e81885d8a2739489cbac361643de96996

Sharing

Copy URL Twitter E-mail

General

Target
b7f4e119aed42d03af852c3f1f2ba71e81885d8a2739489cbac361643de96996
Size 45KB
Sample260701-kac2aabz4x
SHA256 b7f4e119aed42d03af852c3f1f2ba71e81885d8a2739489cbac361643de96996
MD5 86a805875e8777c00c873c2bc98ad936
SHA1 1cfb688f135c3735464b8edf83e6090cb17f2b86
SHA512 8a08ff44f96f39e0ed7554f018b2ab4ca95ac483dbbb4331600fa6c146497f62708fd22564cfc938f0fbc9c663aa452099929328ba31b0900a46c3fb0fa5294f
SSDEEP 768:QulCJTHESwgWUK3aGmo2q9BGFZQjB4PIFfzjbDgX3iZCJDvsMueX73tWBDZgx:QulCJTHl42FqF9Ff3bcXSZYvs1eXp4dS
TLSH
T1DE231A0037E9C12BF2BE4F7899F26145467AF6633603E54D2CC452DB4613FC69A426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
sodinokibi.prettylittleplumbs.com:80
sodinokibi.prettylittleplumbs.com:22
sodinokibi.prettylittleplumbs.com:8080
sodinokibi.prettylittleplumbs.com:8880
sodinokibi.prettylittleplumbs.com:2052
sodinokibi.prettylittleplumbs.com:2082
sodinokibi.prettylittleplumbs.com:2086
sodinokibi.prettylittleplumbs.com:2095
sodinokibi.prettylittleplumbs.com:443
sodinokibi.prettylittleplumbs.com:2053
sodinokibi.prettylittleplumbs.com:2083
sodinokibi.prettylittleplumbs.com:2087
sodinokibi.prettylittleplumbs.com:2096
sodinokibi.prettylittleplumbs.com:8443
zbot.prettylittleplumbs.com:80
zbot.prettylittleplumbs.com:22
zbot.prettylittleplumbs.com:8080
zbot.prettylittleplumbs.com:8880
zbot.prettylittleplumbs.com:2052
zbot.prettylittleplumbs.com:2082
zbot.prettylittleplumbs.com:2086
zbot.prettylittleplumbs.com:2095
zbot.prettylittleplumbs.com:443
zbot.prettylittleplumbs.com:2053
zbot.prettylittleplumbs.com:2083
zbot.prettylittleplumbs.com:2087
zbot.prettylittleplumbs.com:2096
zbot.prettylittleplumbs.com:8443

Mutex

GVtrfiTD0jar

Attributes

delay
0
install
true
install_file
u1g11v.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b7f4e119aed42d03af852c3f1f2ba71e81885d8a2739489cbac361643de96996
- Size 45KB
- SHA256 b7f4e119aed42d03af852c3f1f2ba71e81885d8a2739489cbac361643de96996
- MD5 86a805875e8777c00c873c2bc98ad936
- SHA1 1cfb688f135c3735464b8edf83e6090cb17f2b86
- SHA512 8a08ff44f96f39e0ed7554f018b2ab4ca95ac483dbbb4331600fa6c146497f62708fd22564cfc938f0fbc9c663aa452099929328ba31b0900a46c3fb0fa5294f
- SSDEEP 768:QulCJTHESwgWUK3aGmo2q9BGFZQjB4PIFfzjbDgX3iZCJDvsMueX73tWBDZgx:QulCJTHl42FqF9Ff3bcXSZYvs1eXp4dS
- TLSH
  T1DE231A0037E9C12BF2BE4F7899F26145467AF6633603E54D2CC452DB4613FC69A426EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2