General
- Target 9e98c115-f8bf-4d8e-8d9c-d6b7a06f11d2.exe
- Size 46KB
- Sample260804-pl59eszgnc
- SHA256 e1f606ce1a1a909a5e5a40c0aacb55ccdb8c8edb4e892b433402651bc7e91c91
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.8
Botnet
-
Default
C2
-
Pg55.pro:4441
-
Pg55.pro:1756
-
Pg55.pro:1250
-
Pg55.pro:5126
-
Pg55.pro:4738
-
Pg55.pro:7097
-
Pg55.pro:8235
-
www.Pg55.pro:4441
-
www.Pg55.pro:1756
-
www.Pg55.pro:1250
-
www.Pg55.pro:5126
-
www.Pg55.pro:4738
-
www.Pg55.pro:7097
-
www.Pg55.pro:8235
-
NotPetya.Pg55.pro:4441
-
NotPetya.Pg55.pro:1756
-
NotPetya.Pg55.pro:1250
-
NotPetya.Pg55.pro:5126
-
NotPetya.Pg55.pro:4738
-
NotPetya.Pg55.pro:7097
Mutex
-
HOVxlsQvANeK
Attributes
-
delay
3
-
install
true
-
install_file
pg551.exe
-
install_folder
%AppData%
aes.plain
Targets
-
- Target 9e98c115-f8bf-4d8e-8d9c-d6b7a06f11d2.exe
- Size 46KB
- SHA256 e1f606ce1a1a909a5e5a40c0aacb55ccdb8c8edb4e892b433402651bc7e91c91
Score10/10-
Async RAT payload
-
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE