asyncrat | 6570265f739f798a5aa0a1f0306f2d86214148499811b3cfd50555cc10693b8b

Sharing

Copy URL Twitter E-mail

General

Target
6570265f739f798a5aa0a1f0306f2d86214148499811b3cfd50555cc10693b8b
Size 45KB
Sample260702-jsvhlscw7r
SHA256 6570265f739f798a5aa0a1f0306f2d86214148499811b3cfd50555cc10693b8b
MD5 48f511593d36d7cbc07d38aafbe7d288
SHA1 b85f449f20f9955b4d5923e1d8c9b389fb3542d0
SHA512 6c47bb761dc825de2feb4f61e712519f600e2388601f919ee3e4a4ac45129efa796398c3333b31adc8337822e3a4e71e51553699803ea95a7ffcb3ef0640c92d
SSDEEP 768:juseoZTj4ih7WU7jBbIdmo2qjGeeXKGoibbbQtN8/nPI65zjbKgX3iHRVpXH+BDN:jusHZTjR9bM2AeDAtNKA653bdXSDpXwR
TLSH
T1EC231C003BE8C12BF2BE4FB899F261458A7AF5632603D54A1CC451DB5713FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
mirai.prettylittleplumbs.com:80
mirai.prettylittleplumbs.com:22
mirai.prettylittleplumbs.com:8080
mirai.prettylittleplumbs.com:8880
mirai.prettylittleplumbs.com:2052
mirai.prettylittleplumbs.com:2082
mirai.prettylittleplumbs.com:2086
mirai.prettylittleplumbs.com:2095
mirai.prettylittleplumbs.com:443
mirai.prettylittleplumbs.com:2053
mirai.prettylittleplumbs.com:2083
mirai.prettylittleplumbs.com:2087
mirai.prettylittleplumbs.com:2096
mirai.prettylittleplumbs.com:8443
iloveyou.prettylittleplumbs.com:80
iloveyou.prettylittleplumbs.com:22
iloveyou.prettylittleplumbs.com:8080
iloveyou.prettylittleplumbs.com:8880
iloveyou.prettylittleplumbs.com:2052
iloveyou.prettylittleplumbs.com:2082
iloveyou.prettylittleplumbs.com:2086
iloveyou.prettylittleplumbs.com:2095
iloveyou.prettylittleplumbs.com:443
iloveyou.prettylittleplumbs.com:2053
iloveyou.prettylittleplumbs.com:2083
iloveyou.prettylittleplumbs.com:2087
iloveyou.prettylittleplumbs.com:2096
iloveyou.prettylittleplumbs.com:8443
qakbot.prettylittleplumbs.com:80
qakbot.prettylittleplumbs.com:22
qakbot.prettylittleplumbs.com:8080
qakbot.prettylittleplumbs.com:8880
qakbot.prettylittleplumbs.com:2052
qakbot.prettylittleplumbs.com:2082
qakbot.prettylittleplumbs.com:2086
qakbot.prettylittleplumbs.com:2095
qakbot.prettylittleplumbs.com:443
qakbot.prettylittleplumbs.com:2053
qakbot.prettylittleplumbs.com:2083
qakbot.prettylittleplumbs.com:2087
qakbot.prettylittleplumbs.com:2096
qakbot.prettylittleplumbs.com:8443
klez.prettylittleplumbs.com:80
klez.prettylittleplumbs.com:22
klez.prettylittleplumbs.com:8080
klez.prettylittleplumbs.com:8880
klez.prettylittleplumbs.com:2052
klez.prettylittleplumbs.com:2082
klez.prettylittleplumbs.com:2086
klez.prettylittleplumbs.com:2095
klez.prettylittleplumbs.com:443
klez.prettylittleplumbs.com:2053
klez.prettylittleplumbs.com:2083
klez.prettylittleplumbs.com:2087
klez.prettylittleplumbs.com:2096
klez.prettylittleplumbs.com:8443

Mutex

w9SCyW4lk5WF

Attributes

delay
0
install
true
install_file
65pex.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6570265f739f798a5aa0a1f0306f2d86214148499811b3cfd50555cc10693b8b
- Size 45KB
- SHA256 6570265f739f798a5aa0a1f0306f2d86214148499811b3cfd50555cc10693b8b
- MD5 48f511593d36d7cbc07d38aafbe7d288
- SHA1 b85f449f20f9955b4d5923e1d8c9b389fb3542d0
- SHA512 6c47bb761dc825de2feb4f61e712519f600e2388601f919ee3e4a4ac45129efa796398c3333b31adc8337822e3a4e71e51553699803ea95a7ffcb3ef0640c92d
- SSDEEP 768:juseoZTj4ih7WU7jBbIdmo2qjGeeXKGoibbbQtN8/nPI65zjbKgX3iHRVpXH+BDN:jusHZTjR9bM2AeDAtNKA653bdXSDpXwR
- TLSH
  T1EC231C003BE8C12BF2BE4FB899F261458A7AF5632603D54A1CC451DB5713FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat adware spyware
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2