asyncrat | 145173eaedf1fc138278c21ceb70c9b71b3cd2b4c2ce79dec0c8f5debc641823

Sharing

Copy URL Twitter E-mail

General

Target
145173eaedf1fc138278c21ceb70c9b71b3cd2b4c2ce79dec0c8f5debc641823
Size 45KB
Sample260701-m359msct3l
SHA256 145173eaedf1fc138278c21ceb70c9b71b3cd2b4c2ce79dec0c8f5debc641823
MD5 ec148c05530e1eed12f5fe9964ff1afd
SHA1 5033abc4aaf53e2a5d052f56fe1dc53a54fc9e49
SHA512 3e483f8a5c8d0b128c575fb1c61f15aab35f483cf46f07fa95bbc0facbf7c4fef2f70636f9fde4141000ae03cb85c6008369cbbf9738ce2d7e71d85f86416aef
SSDEEP 768:EulCJTHESwgWUK3aGmo2q95oRQKIJOPIhzjbGgL3i1utu8nPRHk1kLtZBDZsx:EulCJTHl42mYxg3h3bZLSi9JHkEtHdsx
TLSH
T178233B0037E8813BF2BE4F78A9F26145857AF6673603E68A1CC451DB5613FC29A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
emotet.prettylittleplumbs.com:80
emotet.prettylittleplumbs.com:22
emotet.prettylittleplumbs.com:8080
emotet.prettylittleplumbs.com:8880
emotet.prettylittleplumbs.com:2052
emotet.prettylittleplumbs.com:2082
emotet.prettylittleplumbs.com:2086
emotet.prettylittleplumbs.com:2095
emotet.prettylittleplumbs.com:443
emotet.prettylittleplumbs.com:2053
emotet.prettylittleplumbs.com:2083
emotet.prettylittleplumbs.com:2087
emotet.prettylittleplumbs.com:2096
emotet.prettylittleplumbs.com:8443
codered.prettylittleplumbs.com:80
codered.prettylittleplumbs.com:22
codered.prettylittleplumbs.com:8080
codered.prettylittleplumbs.com:8880
codered.prettylittleplumbs.com:2052
codered.prettylittleplumbs.com:2082
codered.prettylittleplumbs.com:2086
codered.prettylittleplumbs.com:2095
codered.prettylittleplumbs.com:443
codered.prettylittleplumbs.com:2053
codered.prettylittleplumbs.com:2083
codered.prettylittleplumbs.com:2087
codered.prettylittleplumbs.com:2096
codered.prettylittleplumbs.com:8443

Mutex

dxmft050zwlT

Attributes

delay
0
install
true
install_file
ohuqch.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  145173eaedf1fc138278c21ceb70c9b71b3cd2b4c2ce79dec0c8f5debc641823
- Size 45KB
- SHA256 145173eaedf1fc138278c21ceb70c9b71b3cd2b4c2ce79dec0c8f5debc641823
- MD5 ec148c05530e1eed12f5fe9964ff1afd
- SHA1 5033abc4aaf53e2a5d052f56fe1dc53a54fc9e49
- SHA512 3e483f8a5c8d0b128c575fb1c61f15aab35f483cf46f07fa95bbc0facbf7c4fef2f70636f9fde4141000ae03cb85c6008369cbbf9738ce2d7e71d85f86416aef
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q95oRQKIJOPIhzjbGgL3i1utu8nPRHk1kLtZBDZsx:EulCJTHl42mYxg3h3bZLSi9JHkEtHdsx
- TLSH
  T178233B0037E8813BF2BE4F78A9F26145857AF6673603E68A1CC451DB5613FC29A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2