asyncrat | 166b8b03f818d793cffbafbb9e27a4501e27955491b0a31d7f018d20e8c4f84d

Sharing

Copy URL Twitter E-mail

General

Target
166b8b03f818d793cffbafbb9e27a4501e27955491b0a31d7f018d20e8c4f84d
Size 45KB
Sample260701-n1f3eafs3s
SHA256 166b8b03f818d793cffbafbb9e27a4501e27955491b0a31d7f018d20e8c4f84d
MD5 7a1f0d6b18457b78c4576e7a834b3f77
SHA1 338d2424edf2082970825c2843b7b93d04e7258a
SHA512 a4a1cb87fe0ec0d5e0950045dbcd31da5f13a3b164ed4c4393144a98f1864b736e20c159ae51e15ef7ada72576b9325312a6af85344f7deb300d1e060f8ed612
SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrLxJdxrPHuPIbzjb+g73iTLhfj3w1YuH0JBDZkx:vuogpT7I62YxR3b3bB7STp34iXdkx
TLSH
T113232B003BE8812BF2BF4FB498F26145467AF5632603D58D2CC451DB5623BC6CA526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
formbook.prettylittleplumbs.com:80
formbook.prettylittleplumbs.com:22
formbook.prettylittleplumbs.com:8080
formbook.prettylittleplumbs.com:8880
formbook.prettylittleplumbs.com:2052
formbook.prettylittleplumbs.com:2082
formbook.prettylittleplumbs.com:2086
formbook.prettylittleplumbs.com:2095
formbook.prettylittleplumbs.com:443
formbook.prettylittleplumbs.com:2053
formbook.prettylittleplumbs.com:2083
formbook.prettylittleplumbs.com:2087
formbook.prettylittleplumbs.com:2096
formbook.prettylittleplumbs.com:8443
trickbot.prettylittleplumbs.com:80
trickbot.prettylittleplumbs.com:22
trickbot.prettylittleplumbs.com:8080
trickbot.prettylittleplumbs.com:8880
trickbot.prettylittleplumbs.com:2052
trickbot.prettylittleplumbs.com:2082
trickbot.prettylittleplumbs.com:2086
trickbot.prettylittleplumbs.com:2095
trickbot.prettylittleplumbs.com:443
trickbot.prettylittleplumbs.com:2053
trickbot.prettylittleplumbs.com:2083
trickbot.prettylittleplumbs.com:2087
trickbot.prettylittleplumbs.com:2096
trickbot.prettylittleplumbs.com:8443
remcos.prettylittleplumbs.com:80
remcos.prettylittleplumbs.com:22
remcos.prettylittleplumbs.com:8080
remcos.prettylittleplumbs.com:8880
remcos.prettylittleplumbs.com:2052
remcos.prettylittleplumbs.com:2082
remcos.prettylittleplumbs.com:2086
remcos.prettylittleplumbs.com:2095
remcos.prettylittleplumbs.com:443
remcos.prettylittleplumbs.com:2053
remcos.prettylittleplumbs.com:2083
remcos.prettylittleplumbs.com:2087
remcos.prettylittleplumbs.com:2096
remcos.prettylittleplumbs.com:8443

Mutex

ZHCYMmG0pB37

Attributes

delay
0
install
true
install_file
y58el9uk.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  166b8b03f818d793cffbafbb9e27a4501e27955491b0a31d7f018d20e8c4f84d
- Size 45KB
- SHA256 166b8b03f818d793cffbafbb9e27a4501e27955491b0a31d7f018d20e8c4f84d
- MD5 7a1f0d6b18457b78c4576e7a834b3f77
- SHA1 338d2424edf2082970825c2843b7b93d04e7258a
- SHA512 a4a1cb87fe0ec0d5e0950045dbcd31da5f13a3b164ed4c4393144a98f1864b736e20c159ae51e15ef7ada72576b9325312a6af85344f7deb300d1e060f8ed612
- SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrLxJdxrPHuPIbzjb+g73iTLhfj3w1YuH0JBDZkx:vuogpT7I62YxR3b3bB7STp34iXdkx
- TLSH
  T113232B003BE8812BF2BF4FB498F26145467AF5632603D58D2CC451DB5623BC6CA526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2