asyncrat | 759bb9366f3a01979ac06dd6baaacb3853b91b4634e8e092087c2c618eaec23c

Sharing

Copy URL Twitter E-mail

General

Target
759bb9366f3a01979ac06dd6baaacb3853b91b4634e8e092087c2c618eaec23c
Size 45KB
Sample260701-pbdfnafv9t
SHA256 759bb9366f3a01979ac06dd6baaacb3853b91b4634e8e092087c2c618eaec23c
MD5 2afa360444a2722e7db0d16fa7f5cfd8
SHA1 1a3ead3a2df7808a26bdf7539439ea822a3f1e22
SHA512 4c2bf64570e2e8fe3621c375f856292bd7a26e926b3406c45231d6783e00bc15b3271c69a648a0e9fbfd639bad2cabd8a03edc435688c0ff2a9d118dd8f72a42
SSDEEP 768:IuuZ5TbUo/BWUlf+DHmo2q7h6R8aI6OPIXzjbrga3ia1QNWA/OmEkBDZFx:IuuZ5Tbjst2g+Fb3X3bUaSPNWiOmESdD
TLSH
T18B232B003BE8812AF2BE4F789DF26245867AF6673603D58E1CC441DB5613FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
cryptolocker.prettylittleplumbs.com:80
cryptolocker.prettylittleplumbs.com:22
cryptolocker.prettylittleplumbs.com:8080
cryptolocker.prettylittleplumbs.com:8880
cryptolocker.prettylittleplumbs.com:2052
cryptolocker.prettylittleplumbs.com:2082
cryptolocker.prettylittleplumbs.com:2086
cryptolocker.prettylittleplumbs.com:2095
cryptolocker.prettylittleplumbs.com:443
cryptolocker.prettylittleplumbs.com:2053
cryptolocker.prettylittleplumbs.com:2083
cryptolocker.prettylittleplumbs.com:2087
cryptolocker.prettylittleplumbs.com:2096
cryptolocker.prettylittleplumbs.com:8443
gozi.prettylittleplumbs.com:80
gozi.prettylittleplumbs.com:22
gozi.prettylittleplumbs.com:8080
gozi.prettylittleplumbs.com:8880
gozi.prettylittleplumbs.com:2052
gozi.prettylittleplumbs.com:2082
gozi.prettylittleplumbs.com:2086
gozi.prettylittleplumbs.com:2095
gozi.prettylittleplumbs.com:443
gozi.prettylittleplumbs.com:2053
gozi.prettylittleplumbs.com:2083
gozi.prettylittleplumbs.com:2087
gozi.prettylittleplumbs.com:2096
gozi.prettylittleplumbs.com:8443
agenttesla.prettylittleplumbs.com:80
agenttesla.prettylittleplumbs.com:22
agenttesla.prettylittleplumbs.com:8080
agenttesla.prettylittleplumbs.com:8880
agenttesla.prettylittleplumbs.com:2052
agenttesla.prettylittleplumbs.com:2082
agenttesla.prettylittleplumbs.com:2086
agenttesla.prettylittleplumbs.com:2095
agenttesla.prettylittleplumbs.com:443
agenttesla.prettylittleplumbs.com:2053
agenttesla.prettylittleplumbs.com:2083
agenttesla.prettylittleplumbs.com:2087
agenttesla.prettylittleplumbs.com:2096
agenttesla.prettylittleplumbs.com:8443
rat.prettylittleplumbs.com:80
rat.prettylittleplumbs.com:22
rat.prettylittleplumbs.com:8080
rat.prettylittleplumbs.com:8880
rat.prettylittleplumbs.com:2052
rat.prettylittleplumbs.com:2082
rat.prettylittleplumbs.com:2086
rat.prettylittleplumbs.com:2095
rat.prettylittleplumbs.com:443
rat.prettylittleplumbs.com:2053
rat.prettylittleplumbs.com:2083
rat.prettylittleplumbs.com:2087
rat.prettylittleplumbs.com:2096
rat.prettylittleplumbs.com:8443

Mutex

BwhSIBVqrvZW

Attributes

delay
0
install
true
install_file
4oj4ui.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  759bb9366f3a01979ac06dd6baaacb3853b91b4634e8e092087c2c618eaec23c
- Size 45KB
- SHA256 759bb9366f3a01979ac06dd6baaacb3853b91b4634e8e092087c2c618eaec23c
- MD5 2afa360444a2722e7db0d16fa7f5cfd8
- SHA1 1a3ead3a2df7808a26bdf7539439ea822a3f1e22
- SHA512 4c2bf64570e2e8fe3621c375f856292bd7a26e926b3406c45231d6783e00bc15b3271c69a648a0e9fbfd639bad2cabd8a03edc435688c0ff2a9d118dd8f72a42
- SSDEEP 768:IuuZ5TbUo/BWUlf+DHmo2q7h6R8aI6OPIXzjbrga3ia1QNWA/OmEkBDZFx:IuuZ5Tbjst2g+Fb3X3bUaSPNWiOmESdD
- TLSH
  T18B232B003BE8812AF2BE4F789DF26245867AF6673603D58E1CC441DB5613FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2