asyncrat | d763c545dbbc494018459765bbfb62c90e2d4e398dd89f6e65821d3d81b0bca2

Sharing

Copy URL Twitter E-mail

General

Target
b3eac2dc-5466-4c44-a3c0-a8c120222b7e.exe
Size 46KB
Sample260804-pl6vyszgpe
SHA256 d763c545dbbc494018459765bbfb62c90e2d4e398dd89f6e65821d3d81b0bca2
MD5 52c2ed41b1f6512e693bce3f3eb05623
SHA1 733fc9e8bef27f3084818dd38e1a1c01b68385b7
SHA512 d480485ac5f303998b1bf2f130ab374e9d040465847d746745cf6e8c26f950a6b38dad478cf52f10ee84b31aa1359ef7b58a67ac9604b1fde04cf9dc9a71933b
SSDEEP 768:wakZwLATjIxvwwuGkx8zYPhPUDWn1PzJIjbag47FzDGYOvOjrGbYf6ymM5bmf+S:wakZwYw2lzKbN4hfjOvOvhyTM5bmf+S
TLSH
T1E8232A043BACC22BF1BE5F74A9F2224546BAF6532603D54D1C8812DA5613FC6CF426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Pg55.pro:4441
Pg55.pro:1756
Pg55.pro:1250
Pg55.pro:5126
Pg55.pro:4738
Pg55.pro:7097
Pg55.pro:8235
www.Pg55.pro:4441
www.Pg55.pro:1756
www.Pg55.pro:1250
www.Pg55.pro:5126
www.Pg55.pro:4738
www.Pg55.pro:7097
www.Pg55.pro:8235
NotPetya.Pg55.pro:4441
NotPetya.Pg55.pro:1756
NotPetya.Pg55.pro:1250
NotPetya.Pg55.pro:5126
NotPetya.Pg55.pro:4738
NotPetya.Pg55.pro:7097
NotPetya.Pg55.pro:8235
Stuxnet.Pg55.pro:4441
Stuxnet.Pg55.pro:1756
Stuxnet.Pg55.pro:1250
Stuxnet.Pg55.pro:5126
Stuxnet.Pg55.pro:4738
Stuxnet.Pg55.pro:7097
Stuxnet.Pg55.pro:8235
Zeus.Pg55.pro:4441
Zeus.Pg55.pro:1756
Zeus.Pg55.pro:1250
Zeus.Pg55.pro:5126
Zeus.Pg55.pro:4738
Zeus.Pg55.pro:7097
Zeus.Pg55.pro:8235
CryptoLocker.Pg55.pro:4441
CryptoLocker.Pg55.pro:1756
CryptoLocker.Pg55.pro:1250
CryptoLocker.Pg55.pro:5126
CryptoLocker.Pg55.pro:4738
CryptoLocker.Pg55.pro:7097
CryptoLocker.Pg55.pro:8235
Pg55.pro/vi-vn/%3A9675:4441
Pg55.pro/vi-vn/%3A9675:1756
Pg55.pro/vi-vn/%3A9675:1250
Pg55.pro/vi-vn/%3A9675:5126
Pg55.pro/vi-vn/%3A9675:4738
Pg55.pro/vi-vn/%3A9675:7097
Pg55.pro/vi-vn/%3A9675:8235
Pg55.pro/vi-vn/%3A1732:4441
Pg55.pro/vi-vn/%3A1732:1756
Pg55.pro/vi-vn/%3A1732:1250
Pg55.pro/vi-vn/%3A1732:5126
Pg55.pro/vi-vn/%3A1732:4738
Pg55.pro/vi-vn/%3A1732:7097
Pg55.pro/vi-vn/%3A1732:8235
Pg55.pro/vi-vn/%3A2185:4441
Pg55.pro/vi-vn/%3A2185:1756
Pg55.pro/vi-vn/%3A2185:1250
Pg55.pro/vi-vn/%3A2185:5126
Pg55.pro/vi-vn/%3A2185:4738
Pg55.pro/vi-vn/%3A2185:7097
Pg55.pro/vi-vn/%3A2185:8235
Pg55.pro/vi-vn/%3A4131:4441
Pg55.pro/vi-vn/%3A4131:1756
Pg55.pro/vi-vn/%3A4131:1250
Pg55.pro/vi-vn/%3A4131:5126
Pg55.pro/vi-vn/%3A4131:4738
Pg55.pro/vi-vn/%3A4131:7097
Pg55.pro/vi-vn/%3A4131:8235
Pg55.pro/vi-vn/%3A4618:4441
Pg55.pro/vi-vn/%3A4618:1756
Pg55.pro/vi-vn/%3A4618:1250
Pg55.pro/vi-vn/%3A4618:5126
Pg55.pro/vi-vn/%3A4618:4738
Pg55.pro/vi-vn/%3A4618:7097
Pg55.pro/vi-vn/%3A4618:8235
Pg55.pro/vi-vn/%3A3587:4441
Pg55.pro/vi-vn/%3A3587:1756
Pg55.pro/vi-vn/%3A3587:1250
Pg55.pro/vi-vn/%3A3587:5126
Pg55.pro/vi-vn/%3A3587:4738
Pg55.pro/vi-vn/%3A3587:7097
Pg55.pro/vi-vn/%3A3587:8235
Pg55.pro/vi-vn/%3A1522:4441
Pg55.pro/vi-vn/%3A1522:1756
Pg55.pro/vi-vn/%3A1522:1250
Pg55.pro/vi-vn/%3A1522:5126
Pg55.pro/vi-vn/%3A1522:4738
Pg55.pro/vi-vn/%3A1522:7097
Pg55.pro/vi-vn/%3A1522:8235

Mutex

HOVxlsQvANeK

Attributes

delay
3
install
true
install_file
pg551.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b3eac2dc-5466-4c44-a3c0-a8c120222b7e.exe
- Size 46KB
- SHA256 d763c545dbbc494018459765bbfb62c90e2d4e398dd89f6e65821d3d81b0bca2
- MD5 52c2ed41b1f6512e693bce3f3eb05623
- SHA1 733fc9e8bef27f3084818dd38e1a1c01b68385b7
- SHA512 d480485ac5f303998b1bf2f130ab374e9d040465847d746745cf6e8c26f950a6b38dad478cf52f10ee84b31aa1359ef7b58a67ac9604b1fde04cf9dc9a71933b
- SSDEEP 768:wakZwLATjIxvwwuGkx8zYPhPUDWn1PzJIjbag47FzDGYOvOjrGbYf6ymM5bmf+S:wakZwYw2lzKbN4hfjOvOvhyTM5bmf+S
- TLSH
  T1E8232A043BACC22BF1BE5F74A9F2224546BAF6532603D54D1C8812DA5613FC6CF426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2