asyncrat | 7b4e4f79122ab8a3ef180f9e4fdcd1f112285d934fb4ce13840d29c0ef0b8e64

Sharing

Copy URL Twitter E-mail

General

Target
7b4e4f79122ab8a3ef180f9e4fdcd1f112285d934fb4ce13840d29c0ef0b8e64
Size 45KB
Sample260701-kylckact6v
SHA256 7b4e4f79122ab8a3ef180f9e4fdcd1f112285d934fb4ce13840d29c0ef0b8e64
MD5 78fa5c55ead821c6fb4ef2dd4afdcbc6
SHA1 08c1e92d43867b2c0255de92791ad4083f80860c
SHA512 28d79b2280fca9108ea832ab80c5e1d9877d4f49120b5478aad3bc0b2480ff14fcab4904fc96c3e0c080cf74edfac956c88d3d725a6ae2d3de3280038f9f6296
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwqls5ohEaMPISCjbbgX3i5fvIVHSTn/IlBDZMx:ku40ZTXEb2e44EaxSObkXS5fmHSTArdO
TLSH
T1BC231A003BE8812BF2BE4F789DF26145867AF5A37603D54A2C8411D75713FC68A52AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
shamoon.prettylittleplumbs.com:80
shamoon.prettylittleplumbs.com:22
shamoon.prettylittleplumbs.com:8080
shamoon.prettylittleplumbs.com:8880
shamoon.prettylittleplumbs.com:2052
shamoon.prettylittleplumbs.com:2082
shamoon.prettylittleplumbs.com:2086
shamoon.prettylittleplumbs.com:2095
shamoon.prettylittleplumbs.com:443
shamoon.prettylittleplumbs.com:2053
shamoon.prettylittleplumbs.com:2083
shamoon.prettylittleplumbs.com:2087
shamoon.prettylittleplumbs.com:2096
shamoon.prettylittleplumbs.com:8443
trickbot.prettylittleplumbs.com:80
trickbot.prettylittleplumbs.com:22
trickbot.prettylittleplumbs.com:8080
trickbot.prettylittleplumbs.com:8880
trickbot.prettylittleplumbs.com:2052
trickbot.prettylittleplumbs.com:2082
trickbot.prettylittleplumbs.com:2086
trickbot.prettylittleplumbs.com:2095
trickbot.prettylittleplumbs.com:443
trickbot.prettylittleplumbs.com:2053
trickbot.prettylittleplumbs.com:2083
trickbot.prettylittleplumbs.com:2087
trickbot.prettylittleplumbs.com:2096
trickbot.prettylittleplumbs.com:8443

Mutex

2HSB2gK6EHOX

Attributes

delay
0
install
true
install_file
0a7ba.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  7b4e4f79122ab8a3ef180f9e4fdcd1f112285d934fb4ce13840d29c0ef0b8e64
- Size 45KB
- SHA256 7b4e4f79122ab8a3ef180f9e4fdcd1f112285d934fb4ce13840d29c0ef0b8e64
- MD5 78fa5c55ead821c6fb4ef2dd4afdcbc6
- SHA1 08c1e92d43867b2c0255de92791ad4083f80860c
- SHA512 28d79b2280fca9108ea832ab80c5e1d9877d4f49120b5478aad3bc0b2480ff14fcab4904fc96c3e0c080cf74edfac956c88d3d725a6ae2d3de3280038f9f6296
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwqls5ohEaMPISCjbbgX3i5fvIVHSTn/IlBDZMx:ku40ZTXEb2e44EaxSObkXS5fmHSTArdO
- TLSH
  T1BC231A003BE8812BF2BE4F789DF26145867AF5A37603D54A2C8411D75713FC68A52AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2