asyncrat | 2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6

Sharing

Copy URL Twitter E-mail

General

Target
2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6
Size 45KB
Sample260701-pyt2xset9n
SHA256 2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6
MD5 81c58e5ddcd17dec3db7c76eb9094386
SHA1 68d4a9599c36fa67e52a0875bdcedc1691b787af
SHA512 e3a1fbff75d2276ded5717a4d8da50359e3ba74cee714670e047e4ed7924cb72f5e33c04ee6fb06b6b67d7600809e294a0bf582f9d4724ba01ffb60641a60016
SSDEEP 768:IuI6epTroGtXWU/jmRmo2qTTyacyPz9OPIVzjbwg33idLTa9zwBDZFx:IuIjpTrlO24yVq3V3b33SdLTa9zmdFx
TLSH
T192233B003BE9C12AF2BE5F78A9F26145867AF2633603D6491CC451DB5713FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
hack.prettylittleplumbs.com:80
hack.prettylittleplumbs.com:22
hack.prettylittleplumbs.com:8080
hack.prettylittleplumbs.com:8880
hack.prettylittleplumbs.com:2052
hack.prettylittleplumbs.com:2082
hack.prettylittleplumbs.com:2086
hack.prettylittleplumbs.com:2095
hack.prettylittleplumbs.com:443
hack.prettylittleplumbs.com:2053
hack.prettylittleplumbs.com:2083
hack.prettylittleplumbs.com:2087
hack.prettylittleplumbs.com:2096
hack.prettylittleplumbs.com:8443
mydoom.prettylittleplumbs.com:80
mydoom.prettylittleplumbs.com:22
mydoom.prettylittleplumbs.com:8080
mydoom.prettylittleplumbs.com:8880
mydoom.prettylittleplumbs.com:2052
mydoom.prettylittleplumbs.com:2082
mydoom.prettylittleplumbs.com:2086
mydoom.prettylittleplumbs.com:2095
mydoom.prettylittleplumbs.com:443
mydoom.prettylittleplumbs.com:2053
mydoom.prettylittleplumbs.com:2083
mydoom.prettylittleplumbs.com:2087
mydoom.prettylittleplumbs.com:2096
mydoom.prettylittleplumbs.com:8443
malware.prettylittleplumbs.com:80
malware.prettylittleplumbs.com:22
malware.prettylittleplumbs.com:8080
malware.prettylittleplumbs.com:8880
malware.prettylittleplumbs.com:2052
malware.prettylittleplumbs.com:2082
malware.prettylittleplumbs.com:2086
malware.prettylittleplumbs.com:2095
malware.prettylittleplumbs.com:443
malware.prettylittleplumbs.com:2053
malware.prettylittleplumbs.com:2083
malware.prettylittleplumbs.com:2087
malware.prettylittleplumbs.com:2096
malware.prettylittleplumbs.com:8443
klez.prettylittleplumbs.com:80
klez.prettylittleplumbs.com:22
klez.prettylittleplumbs.com:8080
klez.prettylittleplumbs.com:8880
klez.prettylittleplumbs.com:2052
klez.prettylittleplumbs.com:2082
klez.prettylittleplumbs.com:2086
klez.prettylittleplumbs.com:2095
klez.prettylittleplumbs.com:443
klez.prettylittleplumbs.com:2053
klez.prettylittleplumbs.com:2083
klez.prettylittleplumbs.com:2087
klez.prettylittleplumbs.com:2096
klez.prettylittleplumbs.com:8443

Mutex

XmPXtXLg09Cm

Attributes

delay
0
install
true
install_file
jp9vigm.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6
- Size 45KB
- SHA256 2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6
- MD5 81c58e5ddcd17dec3db7c76eb9094386
- SHA1 68d4a9599c36fa67e52a0875bdcedc1691b787af
- SHA512 e3a1fbff75d2276ded5717a4d8da50359e3ba74cee714670e047e4ed7924cb72f5e33c04ee6fb06b6b67d7600809e294a0bf582f9d4724ba01ffb60641a60016
- SSDEEP 768:IuI6epTroGtXWU/jmRmo2qTTyacyPz9OPIVzjbwg33idLTa9zwBDZFx:IuIjpTrlO24yVq3V3b33SdLTa9zmdFx
- TLSH
  T192233B003BE9C12AF2BE5F78A9F26145867AF2633603D6491CC451DB5713FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2