asyncrat | a10402c5ba6890dd68cb0ae3dbf5b497f180bedd96e6ebaf6d7bdf18adafce6c

Sharing

Copy URL Twitter E-mail

General

Target
a10402c5ba6890dd68cb0ae3dbf5b497f180bedd96e6ebaf6d7bdf18adafce6c
Size 45KB
Sample260701-sdvphagx2m
SHA256 a10402c5ba6890dd68cb0ae3dbf5b497f180bedd96e6ebaf6d7bdf18adafce6c
MD5 6ac5b57f23c19a068ee44a72d7f83bc1
SHA1 618208fab1c0efa2731db6c78ec75143ca0a5eab
SHA512 56d778fe642a7a8f690de0153a9ad2f36461dcc213a6274eef0c707ab32675e619ce8777b9787d706ce58011d745804d1ad61e22e61be7ae48ef80baa793b941
SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMITnyfaaPIgzjbxgX3ihwGpuxEuWzgVCBjnBDZ8x:0u2vpTDe+2FEhg3b+XS+G8b1iBd8x
TLSH
T117232A003BE9C12BF2BE5F78ADF26145467AF6632A03D58D1CC411DB5613BC28652AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
ryuk.prettylittleplumbs.com:80
ryuk.prettylittleplumbs.com:22
ryuk.prettylittleplumbs.com:8080
ryuk.prettylittleplumbs.com:8880
ryuk.prettylittleplumbs.com:2052
ryuk.prettylittleplumbs.com:2082
ryuk.prettylittleplumbs.com:2086
ryuk.prettylittleplumbs.com:2095
ryuk.prettylittleplumbs.com:443
ryuk.prettylittleplumbs.com:2053
ryuk.prettylittleplumbs.com:2083
ryuk.prettylittleplumbs.com:2087
ryuk.prettylittleplumbs.com:2096
ryuk.prettylittleplumbs.com:8443
darkside.prettylittleplumbs.com:80
darkside.prettylittleplumbs.com:22
darkside.prettylittleplumbs.com:8080
darkside.prettylittleplumbs.com:8880
darkside.prettylittleplumbs.com:2052
darkside.prettylittleplumbs.com:2082
darkside.prettylittleplumbs.com:2086
darkside.prettylittleplumbs.com:2095
darkside.prettylittleplumbs.com:443
darkside.prettylittleplumbs.com:2053
darkside.prettylittleplumbs.com:2083
darkside.prettylittleplumbs.com:2087
darkside.prettylittleplumbs.com:2096
darkside.prettylittleplumbs.com:8443
notpetya.prettylittleplumbs.com:80
notpetya.prettylittleplumbs.com:22
notpetya.prettylittleplumbs.com:8080
notpetya.prettylittleplumbs.com:8880
notpetya.prettylittleplumbs.com:2052
notpetya.prettylittleplumbs.com:2082
notpetya.prettylittleplumbs.com:2086
notpetya.prettylittleplumbs.com:2095
notpetya.prettylittleplumbs.com:443
notpetya.prettylittleplumbs.com:2053
notpetya.prettylittleplumbs.com:2083
notpetya.prettylittleplumbs.com:2087
notpetya.prettylittleplumbs.com:2096
notpetya.prettylittleplumbs.com:8443

Mutex

c5iRdp0bQAGw

Attributes

delay
0
install
true
install_file
9aftsc3.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a10402c5ba6890dd68cb0ae3dbf5b497f180bedd96e6ebaf6d7bdf18adafce6c
- Size 45KB
- SHA256 a10402c5ba6890dd68cb0ae3dbf5b497f180bedd96e6ebaf6d7bdf18adafce6c
- MD5 6ac5b57f23c19a068ee44a72d7f83bc1
- SHA1 618208fab1c0efa2731db6c78ec75143ca0a5eab
- SHA512 56d778fe642a7a8f690de0153a9ad2f36461dcc213a6274eef0c707ab32675e619ce8777b9787d706ce58011d745804d1ad61e22e61be7ae48ef80baa793b941
- SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMITnyfaaPIgzjbxgX3ihwGpuxEuWzgVCBjnBDZ8x:0u2vpTDe+2FEhg3b+XS+G8b1iBd8x
- TLSH
  T117232A003BE9C12BF2BE5F78ADF26145467AF6632A03D58D1CC411DB5613BC28652AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2