asyncrat | f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f

Sharing

Copy URL Twitter E-mail

General

Target
f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f
Size 45KB
Sample260701-s6ffaahv9m
SHA256 f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f
MD5 4f593cf205d68da0f94afb4e85350705
SHA1 ef0a5422b91fa79f1c3e7f04ef9d09d291f7b4db
SHA512 5b9fea8d2d3db11b09c4b6848c3d3b339dbd2babf73a488bf14c878b7032c0fd02c4c004a98d67fcfccf24174da9933b9f5ceb4ee844c8042d34ef9aa40721ff
SSDEEP 768:gu61pTscmXLdWUpCSbmo2qrQBz3QKx7PIQJjbSgX3izRSOW0LzOTLUBDZNx:gu61pTsHXB2DV0QpbVXSlWVadNx
TLSH
T12C232B003BE8813BF2BE4FB899F26105857AF6633603D6496CC452D75623FC6DA426F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
gootloader.prettylittleplumbs.com:80
gootloader.prettylittleplumbs.com:22
gootloader.prettylittleplumbs.com:8080
gootloader.prettylittleplumbs.com:8880
gootloader.prettylittleplumbs.com:2052
gootloader.prettylittleplumbs.com:2082
gootloader.prettylittleplumbs.com:2086
gootloader.prettylittleplumbs.com:2095
gootloader.prettylittleplumbs.com:443
gootloader.prettylittleplumbs.com:2053
gootloader.prettylittleplumbs.com:2083
gootloader.prettylittleplumbs.com:2087
gootloader.prettylittleplumbs.com:2096
gootloader.prettylittleplumbs.com:8443
downadup.prettylittleplumbs.com:80
downadup.prettylittleplumbs.com:22
downadup.prettylittleplumbs.com:8080
downadup.prettylittleplumbs.com:8880
downadup.prettylittleplumbs.com:2052
downadup.prettylittleplumbs.com:2082
downadup.prettylittleplumbs.com:2086
downadup.prettylittleplumbs.com:2095
downadup.prettylittleplumbs.com:443
downadup.prettylittleplumbs.com:2053
downadup.prettylittleplumbs.com:2083
downadup.prettylittleplumbs.com:2087
downadup.prettylittleplumbs.com:2096
downadup.prettylittleplumbs.com:8443
gozi.prettylittleplumbs.com:80
gozi.prettylittleplumbs.com:22
gozi.prettylittleplumbs.com:8080
gozi.prettylittleplumbs.com:8880
gozi.prettylittleplumbs.com:2052
gozi.prettylittleplumbs.com:2082
gozi.prettylittleplumbs.com:2086
gozi.prettylittleplumbs.com:2095
gozi.prettylittleplumbs.com:443
gozi.prettylittleplumbs.com:2053
gozi.prettylittleplumbs.com:2083
gozi.prettylittleplumbs.com:2087
gozi.prettylittleplumbs.com:2096
gozi.prettylittleplumbs.com:8443
triton.prettylittleplumbs.com:80
triton.prettylittleplumbs.com:22
triton.prettylittleplumbs.com:8080
triton.prettylittleplumbs.com:8880
triton.prettylittleplumbs.com:2052
triton.prettylittleplumbs.com:2082
triton.prettylittleplumbs.com:2086
triton.prettylittleplumbs.com:2095
triton.prettylittleplumbs.com:443
triton.prettylittleplumbs.com:2053
triton.prettylittleplumbs.com:2083
triton.prettylittleplumbs.com:2087
triton.prettylittleplumbs.com:2096
triton.prettylittleplumbs.com:8443

Mutex

Wqc2wYuvGEUE

Attributes

delay
0
install
true
install_file
fe4t427b.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f
- Size 45KB
- SHA256 f903693d7918cccdc6038fa3be8645b13171df923a4e5345570f5ad91515798f
- MD5 4f593cf205d68da0f94afb4e85350705
- SHA1 ef0a5422b91fa79f1c3e7f04ef9d09d291f7b4db
- SHA512 5b9fea8d2d3db11b09c4b6848c3d3b339dbd2babf73a488bf14c878b7032c0fd02c4c004a98d67fcfccf24174da9933b9f5ceb4ee844c8042d34ef9aa40721ff
- SSDEEP 768:gu61pTscmXLdWUpCSbmo2qrQBz3QKx7PIQJjbSgX3izRSOW0LzOTLUBDZNx:gu61pTsHXB2DV0QpbVXSlWVadNx
- TLSH
  T12C232B003BE8813BF2BE4FB899F26105857AF6633603D6496CC452D75623FC6DA426F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2