asyncrat | 2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6

Sharing

Copy URL Twitter E-mail

General

Target
2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6
Size 45KB
Sample260701-pyt2xset9n
SHA256 2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6
MD5 81c58e5ddcd17dec3db7c76eb9094386
SHA1 68d4a9599c36fa67e52a0875bdcedc1691b787af
SHA512 e3a1fbff75d2276ded5717a4d8da50359e3ba74cee714670e047e4ed7924cb72f5e33c04ee6fb06b6b67d7600809e294a0bf582f9d4724ba01ffb60641a60016
SSDEEP 768:IuI6epTroGtXWU/jmRmo2qTTyacyPz9OPIVzjbwg33idLTa9zwBDZFx:IuIjpTrlO24yVq3V3b33SdLTa9zmdFx
TLSH
T192233B003BE9C12AF2BE5F78A9F26145867AF2633603D6491CC451DB5713FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
hack.prettylittleplumbs.com:80
hack.prettylittleplumbs.com:22
hack.prettylittleplumbs.com:8080
hack.prettylittleplumbs.com:8880
hack.prettylittleplumbs.com:2052
hack.prettylittleplumbs.com:2082
hack.prettylittleplumbs.com:2086
hack.prettylittleplumbs.com:2095
hack.prettylittleplumbs.com:443
hack.prettylittleplumbs.com:2053
hack.prettylittleplumbs.com:2083
hack.prettylittleplumbs.com:2087
hack.prettylittleplumbs.com:2096
hack.prettylittleplumbs.com:8443
mydoom.prettylittleplumbs.com:80
mydoom.prettylittleplumbs.com:22
mydoom.prettylittleplumbs.com:8080
mydoom.prettylittleplumbs.com:8880
mydoom.prettylittleplumbs.com:2052
mydoom.prettylittleplumbs.com:2082
mydoom.prettylittleplumbs.com:2086
mydoom.prettylittleplumbs.com:2095
mydoom.prettylittleplumbs.com:443
mydoom.prettylittleplumbs.com:2053
mydoom.prettylittleplumbs.com:2083
mydoom.prettylittleplumbs.com:2087
mydoom.prettylittleplumbs.com:2096
mydoom.prettylittleplumbs.com:8443
malware.prettylittleplumbs.com:80
malware.prettylittleplumbs.com:22
malware.prettylittleplumbs.com:8080
malware.prettylittleplumbs.com:8880
malware.prettylittleplumbs.com:2052
malware.prettylittleplumbs.com:2082
malware.prettylittleplumbs.com:2086
malware.prettylittleplumbs.com:2095
malware.prettylittleplumbs.com:443
malware.prettylittleplumbs.com:2053
malware.prettylittleplumbs.com:2083
malware.prettylittleplumbs.com:2087
malware.prettylittleplumbs.com:2096
malware.prettylittleplumbs.com:8443
klez.prettylittleplumbs.com:80
klez.prettylittleplumbs.com:22
klez.prettylittleplumbs.com:8080
klez.prettylittleplumbs.com:8880
klez.prettylittleplumbs.com:2052
klez.prettylittleplumbs.com:2082
klez.prettylittleplumbs.com:2086
klez.prettylittleplumbs.com:2095
klez.prettylittleplumbs.com:443
klez.prettylittleplumbs.com:2053
klez.prettylittleplumbs.com:2083
klez.prettylittleplumbs.com:2087
klez.prettylittleplumbs.com:2096
klez.prettylittleplumbs.com:8443

Mutex

XmPXtXLg09Cm

Attributes

delay
0
install
true
install_file
jp9vigm.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6

File Explorer

2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6

.exe 45KB

2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6
MD5 81c58e5ddcd17dec3db7c76eb9094386
SHA1 68d4a9599c36fa67e52a0875bdcedc1691b787af
SHA512 e3a1fbff75d2276ded5717a4d8da50359e3ba74cee714670e047e4ed7924cb72f5e33c04ee6fb06b6b67d7600809e294a0bf582f9d4724ba01ffb60641a60016
SSDEEP 768:IuI6epTroGtXWU/jmRmo2qTTyacyPz9OPIVzjbwg33idLTa9zwBDZFx:IuIjpTrlO24yVq3V3b33SdLTa9zmdFx
TLSH
T192233B003BE9C12AF2BE5F78A9F26145867AF2633603D6491CC451DB5713FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

2aaacef5e7541578799aafa360d0c5ab978cb8bebc16b21f62293f3956ba3cb6

mscoree

dotnet