asyncrat | c20244730c0f245fc7910d00203df9253c21fb1954aef587d402328094e5697f

Sharing

Copy URL Twitter E-mail

General

Target
c20244730c0f245fc7910d00203df9253c21fb1954aef587d402328094e5697f
Size 45KB
Sample260701-pn4tdaes5m
SHA256 c20244730c0f245fc7910d00203df9253c21fb1954aef587d402328094e5697f
MD5 caf539d589bda7b6dd6d091e376f3b2b
SHA1 228e81fa21089352af0f983a62abbff9cc8697c1
SHA512 29764230588d81e6d27662a866eca737e2c126af468ba3f1a7f96577f9c6a955e045308886286c633add64bf5dc50bd3041e289e173948d2c1441ebc9d929947
SSDEEP 768:juseoZTj4ih7WU7jBbIdmo2qjP3Fo9EaOPIpzjb4gX3iTO378VFDFBDZdx:jusHZTjR9bM2E8Ea3p3bvXSa374Hddx
TLSH
T19B231A003BE9C127F2BE4FB89CF261458A7AF5636603D5491CC4419B5B13FC69A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
cryptolocker.prettylittleplumbs.com:80
cryptolocker.prettylittleplumbs.com:22
cryptolocker.prettylittleplumbs.com:8080
cryptolocker.prettylittleplumbs.com:8880
cryptolocker.prettylittleplumbs.com:2052
cryptolocker.prettylittleplumbs.com:2082
cryptolocker.prettylittleplumbs.com:2086
cryptolocker.prettylittleplumbs.com:2095
cryptolocker.prettylittleplumbs.com:443
cryptolocker.prettylittleplumbs.com:2053
cryptolocker.prettylittleplumbs.com:2083
cryptolocker.prettylittleplumbs.com:2087
cryptolocker.prettylittleplumbs.com:2096
cryptolocker.prettylittleplumbs.com:8443
zeus.prettylittleplumbs.com:80
zeus.prettylittleplumbs.com:22
zeus.prettylittleplumbs.com:8080
zeus.prettylittleplumbs.com:8880
zeus.prettylittleplumbs.com:2052
zeus.prettylittleplumbs.com:2082
zeus.prettylittleplumbs.com:2086
zeus.prettylittleplumbs.com:2095
zeus.prettylittleplumbs.com:443
zeus.prettylittleplumbs.com:2053
zeus.prettylittleplumbs.com:2083
zeus.prettylittleplumbs.com:2087
zeus.prettylittleplumbs.com:2096
zeus.prettylittleplumbs.com:8443
clop.prettylittleplumbs.com:80
clop.prettylittleplumbs.com:22
clop.prettylittleplumbs.com:8080
clop.prettylittleplumbs.com:8880
clop.prettylittleplumbs.com:2052
clop.prettylittleplumbs.com:2082
clop.prettylittleplumbs.com:2086
clop.prettylittleplumbs.com:2095
clop.prettylittleplumbs.com:443
clop.prettylittleplumbs.com:2053
clop.prettylittleplumbs.com:2083
clop.prettylittleplumbs.com:2087
clop.prettylittleplumbs.com:2096
clop.prettylittleplumbs.com:8443
cl0p.prettylittleplumbs.com:80
cl0p.prettylittleplumbs.com:22
cl0p.prettylittleplumbs.com:8080
cl0p.prettylittleplumbs.com:8880
cl0p.prettylittleplumbs.com:2052
cl0p.prettylittleplumbs.com:2082
cl0p.prettylittleplumbs.com:2086
cl0p.prettylittleplumbs.com:2095
cl0p.prettylittleplumbs.com:443
cl0p.prettylittleplumbs.com:2053
cl0p.prettylittleplumbs.com:2083
cl0p.prettylittleplumbs.com:2087
cl0p.prettylittleplumbs.com:2096
cl0p.prettylittleplumbs.com:8443

Mutex

pt6ATdV0TLwk

Attributes

delay
0
install
true
install_file
3uuf3.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c20244730c0f245fc7910d00203df9253c21fb1954aef587d402328094e5697f
- Size 45KB
- SHA256 c20244730c0f245fc7910d00203df9253c21fb1954aef587d402328094e5697f
- MD5 caf539d589bda7b6dd6d091e376f3b2b
- SHA1 228e81fa21089352af0f983a62abbff9cc8697c1
- SHA512 29764230588d81e6d27662a866eca737e2c126af468ba3f1a7f96577f9c6a955e045308886286c633add64bf5dc50bd3041e289e173948d2c1441ebc9d929947
- SSDEEP 768:juseoZTj4ih7WU7jBbIdmo2qjP3Fo9EaOPIpzjb4gX3iTO378VFDFBDZdx:jusHZTjR9bM2E8Ea3p3bvXSa374Hddx
- TLSH
  T19B231A003BE9C127F2BE4FB89CF261458A7AF5636603D5491CC4419B5B13FC69A42AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2