asyncrat | 93b62151aeee4f99132c19b8da2e8eeecac13dd16b0ff1fbffdf02a05b778f9c

Sharing

Copy URL Twitter E-mail

General

Target
93b62151aeee4f99132c19b8da2e8eeecac13dd16b0ff1fbffdf02a05b778f9c
Size 45KB
Sample260702-jmvlescv5j
SHA256 93b62151aeee4f99132c19b8da2e8eeecac13dd16b0ff1fbffdf02a05b778f9c
MD5 07492018bb9b3349af31e19a5b72d82c
SHA1 7a5db4f5cfb5e2a0acaba1111d2d485389ee041e
SHA512 bbeccad98ee85283c935d99cdca68b7db975dc1c1885fe54d76cd6126c4971a77e51f528ae06a2e465e592d7d2dee762eb6b41f98fd7073290747793d0e984e5
SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qj4ozfy3CKPItfjbEgX3iJUyjryk9BDZ8x:0u2vpTDe+22TRtrbLXSjiad8x
TLSH
T15C232B003BE9C12BF2BF5B749DF26145867AF6632603D58E1CC411DB5713BC29A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
sasser.prettylittleplumbs.com:80
sasser.prettylittleplumbs.com:22
sasser.prettylittleplumbs.com:8080
sasser.prettylittleplumbs.com:8880
sasser.prettylittleplumbs.com:2052
sasser.prettylittleplumbs.com:2082
sasser.prettylittleplumbs.com:2086
sasser.prettylittleplumbs.com:2095
sasser.prettylittleplumbs.com:443
sasser.prettylittleplumbs.com:2053
sasser.prettylittleplumbs.com:2083
sasser.prettylittleplumbs.com:2087
sasser.prettylittleplumbs.com:2096
sasser.prettylittleplumbs.com:8443
gozi.prettylittleplumbs.com:80
gozi.prettylittleplumbs.com:22
gozi.prettylittleplumbs.com:8080
gozi.prettylittleplumbs.com:8880
gozi.prettylittleplumbs.com:2052
gozi.prettylittleplumbs.com:2082
gozi.prettylittleplumbs.com:2086
gozi.prettylittleplumbs.com:2095
gozi.prettylittleplumbs.com:443
gozi.prettylittleplumbs.com:2053
gozi.prettylittleplumbs.com:2083
gozi.prettylittleplumbs.com:2087
gozi.prettylittleplumbs.com:2096
gozi.prettylittleplumbs.com:8443
iloveyou.prettylittleplumbs.com:80
iloveyou.prettylittleplumbs.com:22
iloveyou.prettylittleplumbs.com:8080
iloveyou.prettylittleplumbs.com:8880
iloveyou.prettylittleplumbs.com:2052
iloveyou.prettylittleplumbs.com:2082
iloveyou.prettylittleplumbs.com:2086
iloveyou.prettylittleplumbs.com:2095
iloveyou.prettylittleplumbs.com:443
iloveyou.prettylittleplumbs.com:2053
iloveyou.prettylittleplumbs.com:2083
iloveyou.prettylittleplumbs.com:2087
iloveyou.prettylittleplumbs.com:2096
iloveyou.prettylittleplumbs.com:8443

Mutex

PGWa7VMjd4vN

Attributes

delay
0
install
true
install_file
2iw5lab.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  93b62151aeee4f99132c19b8da2e8eeecac13dd16b0ff1fbffdf02a05b778f9c
- Size 45KB
- SHA256 93b62151aeee4f99132c19b8da2e8eeecac13dd16b0ff1fbffdf02a05b778f9c
- MD5 07492018bb9b3349af31e19a5b72d82c
- SHA1 7a5db4f5cfb5e2a0acaba1111d2d485389ee041e
- SHA512 bbeccad98ee85283c935d99cdca68b7db975dc1c1885fe54d76cd6126c4971a77e51f528ae06a2e465e592d7d2dee762eb6b41f98fd7073290747793d0e984e5
- SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qj4ozfy3CKPItfjbEgX3iJUyjryk9BDZ8x:0u2vpTDe+22TRtrbLXSjiad8x
- TLSH
  T15C232B003BE9C12BF2BF5B749DF26145867AF6632603D58E1CC411DB5713BC29A42AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2