asyncrat | 89075abfa872d1239d67e7394e2c50e2f12b2bf40bb5161d3a6d80c32046bdd0

Sharing

Copy URL Twitter E-mail

General

Target
89075abfa872d1239d67e7394e2c50e2f12b2bf40bb5161d3a6d80c32046bdd0
Size 45KB
Sample260702-k7m8hsfs4w
SHA256 89075abfa872d1239d67e7394e2c50e2f12b2bf40bb5161d3a6d80c32046bdd0
MD5 6adf3054c8addb7ec2ce33bed4a76996
SHA1 11e72839650689fafcb3ec5521c7c1b4aace1014
SHA512 c80c5a20a0b457d5bafefc653e89b5e1a47d91bda2432e67c7e075e4857265305c3439b5a66c65e4b1fc25c6e7befe4cdfacd1c01dade62eab2fea6bd46eb534
SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7d/zBNMwpGPIMuzjbYgX3WtBJ3xxbOJfBDZ8x:0ushJTDXgH2o1GYvMu3bPXGtb3bOPd8x
TLSH
T1A6231B0037E8822BF2BE4F7899F26145867AF6633603D64A1CC451DB5713FC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

prettylittleplumbs.com:80
prettylittleplumbs.com:22
prettylittleplumbs.com:8080
prettylittleplumbs.com:8880
prettylittleplumbs.com:2052
prettylittleplumbs.com:2082
prettylittleplumbs.com:2086
prettylittleplumbs.com:2095
prettylittleplumbs.com:443
prettylittleplumbs.com:2053
prettylittleplumbs.com:2083
prettylittleplumbs.com:2087
prettylittleplumbs.com:2096
prettylittleplumbs.com:8443
www.prettylittleplumbs.com:80
www.prettylittleplumbs.com:22
www.prettylittleplumbs.com:8080
www.prettylittleplumbs.com:8880
www.prettylittleplumbs.com:2052
www.prettylittleplumbs.com:2082
www.prettylittleplumbs.com:2086
www.prettylittleplumbs.com:2095
www.prettylittleplumbs.com:443
www.prettylittleplumbs.com:2053
www.prettylittleplumbs.com:2083
www.prettylittleplumbs.com:2087
www.prettylittleplumbs.com:2096
www.prettylittleplumbs.com:8443
sodinokibi.prettylittleplumbs.com:80
sodinokibi.prettylittleplumbs.com:22
sodinokibi.prettylittleplumbs.com:8080
sodinokibi.prettylittleplumbs.com:8880
sodinokibi.prettylittleplumbs.com:2052
sodinokibi.prettylittleplumbs.com:2082
sodinokibi.prettylittleplumbs.com:2086
sodinokibi.prettylittleplumbs.com:2095
sodinokibi.prettylittleplumbs.com:443
sodinokibi.prettylittleplumbs.com:2053
sodinokibi.prettylittleplumbs.com:2083
sodinokibi.prettylittleplumbs.com:2087
sodinokibi.prettylittleplumbs.com:2096
sodinokibi.prettylittleplumbs.com:8443
hack.prettylittleplumbs.com:80
hack.prettylittleplumbs.com:22
hack.prettylittleplumbs.com:8080
hack.prettylittleplumbs.com:8880
hack.prettylittleplumbs.com:2052
hack.prettylittleplumbs.com:2082
hack.prettylittleplumbs.com:2086
hack.prettylittleplumbs.com:2095
hack.prettylittleplumbs.com:443
hack.prettylittleplumbs.com:2053
hack.prettylittleplumbs.com:2083
hack.prettylittleplumbs.com:2087
hack.prettylittleplumbs.com:2096
hack.prettylittleplumbs.com:8443
conti.prettylittleplumbs.com:80
conti.prettylittleplumbs.com:22
conti.prettylittleplumbs.com:8080
conti.prettylittleplumbs.com:8880
conti.prettylittleplumbs.com:2052
conti.prettylittleplumbs.com:2082
conti.prettylittleplumbs.com:2086
conti.prettylittleplumbs.com:2095
conti.prettylittleplumbs.com:443
conti.prettylittleplumbs.com:2053
conti.prettylittleplumbs.com:2083
conti.prettylittleplumbs.com:2087
conti.prettylittleplumbs.com:2096
conti.prettylittleplumbs.com:8443

Mutex

9sqDpnnIiKVh

Attributes

delay
0
install
true
install_file
hah1rr.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  89075abfa872d1239d67e7394e2c50e2f12b2bf40bb5161d3a6d80c32046bdd0
- Size 45KB
- SHA256 89075abfa872d1239d67e7394e2c50e2f12b2bf40bb5161d3a6d80c32046bdd0
- MD5 6adf3054c8addb7ec2ce33bed4a76996
- SHA1 11e72839650689fafcb3ec5521c7c1b4aace1014
- SHA512 c80c5a20a0b457d5bafefc653e89b5e1a47d91bda2432e67c7e075e4857265305c3439b5a66c65e4b1fc25c6e7befe4cdfacd1c01dade62eab2fea6bd46eb534
- SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7d/zBNMwpGPIMuzjbYgX3WtBJ3xxbOJfBDZ8x:0ushJTDXgH2o1GYvMu3bPXGtb3bOPd8x
- TLSH
  T1A6231B0037E8822BF2BE4F7899F26145867AF6633603D64A1CC451DB5713FC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2