asyncrat | f9ce4f07f13cb5a2f30bf782833d91ed4c352e89543ff40bbe975162d73e6c4a

Sharing

Copy URL Twitter E-mail

General

Target
538ad8e4-e932-4a38-8a1f-eb7af19157e4.exe
Size 46KB
Sample260804-pps39swybz
SHA256 f9ce4f07f13cb5a2f30bf782833d91ed4c352e89543ff40bbe975162d73e6c4a
MD5 3df194c7b40b81fe15116956ee15e0d2
SHA1 89b32ff2b60d925e0caac0460114baa98ae5749b
SHA512 159b56f8430b75766dbc6b3399575adcfa6c7669a41529b8d0d27cbd74573d7ca64cca42aad2a68beae238582b4388de09f2b6e7e39b329e6335122ae26c374e
SSDEEP 768:Qak0CLeA7rxvFwJGEx8T72hA9w1PKJIjb6g4ZFf4XDYrvBZ/8oNmM5bGf+R:Qak0CJdv3SKKbt4TfQYVZ/eM5bGf+R
TLSH
T1F52329007BED822AF2BE9F7899F2224546B9F2532603D5491C8812DB5613FC1CB426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

pg55.bingo:4441
pg55.bingo:1756
pg55.bingo:1250
pg55.bingo:5126
pg55.bingo:4738
pg55.bingo:7097
pg55.bingo:8235
www.pg55.bingo:4441
www.pg55.bingo:1756
www.pg55.bingo:1250
www.pg55.bingo:5126
www.pg55.bingo:4738
www.pg55.bingo:7097
www.pg55.bingo:8235
NotPetya.pg55.bingo:4441
NotPetya.pg55.bingo:1756
NotPetya.pg55.bingo:1250
NotPetya.pg55.bingo:5126
NotPetya.pg55.bingo:4738
NotPetya.pg55.bingo:7097
NotPetya.pg55.bingo:8235
Stuxnet.pg55.bingo:4441
Stuxnet.pg55.bingo:1756
Stuxnet.pg55.bingo:1250
Stuxnet.pg55.bingo:5126
Stuxnet.pg55.bingo:4738
Stuxnet.pg55.bingo:7097
Stuxnet.pg55.bingo:8235
Zeus.pg55.bingo:4441
Zeus.pg55.bingo:1756
Zeus.pg55.bingo:1250
Zeus.pg55.bingo:5126
Zeus.pg55.bingo:4738
Zeus.pg55.bingo:7097
Zeus.pg55.bingo:8235
CryptoLocker.pg55.bingo:4441
CryptoLocker.pg55.bingo:1756
CryptoLocker.pg55.bingo:1250
CryptoLocker.pg55.bingo:5126
CryptoLocker.pg55.bingo:4738
CryptoLocker.pg55.bingo:7097
CryptoLocker.pg55.bingo:8235
pg55.bingo/vi-vn/%3A8405:4441
pg55.bingo/vi-vn/%3A8405:1756
pg55.bingo/vi-vn/%3A8405:1250
pg55.bingo/vi-vn/%3A8405:5126
pg55.bingo/vi-vn/%3A8405:4738
pg55.bingo/vi-vn/%3A8405:7097
pg55.bingo/vi-vn/%3A8405:8235
pg55.bingo/vi-vn/%3A1968:4441
pg55.bingo/vi-vn/%3A1968:1756
pg55.bingo/vi-vn/%3A1968:1250
pg55.bingo/vi-vn/%3A1968:5126
pg55.bingo/vi-vn/%3A1968:4738
pg55.bingo/vi-vn/%3A1968:7097
pg55.bingo/vi-vn/%3A1968:8235
pg55.bingo/vi-vn/%3A8121:4441
pg55.bingo/vi-vn/%3A8121:1756
pg55.bingo/vi-vn/%3A8121:1250
pg55.bingo/vi-vn/%3A8121:5126
pg55.bingo/vi-vn/%3A8121:4738
pg55.bingo/vi-vn/%3A8121:7097
pg55.bingo/vi-vn/%3A8121:8235
pg55.bingo/vi-vn/%3A7513:4441
pg55.bingo/vi-vn/%3A7513:1756
pg55.bingo/vi-vn/%3A7513:1250
pg55.bingo/vi-vn/%3A7513:5126
pg55.bingo/vi-vn/%3A7513:4738
pg55.bingo/vi-vn/%3A7513:7097
pg55.bingo/vi-vn/%3A7513:8235
pg55.bingo/vi-vn/%3A6606:4441
pg55.bingo/vi-vn/%3A6606:1756
pg55.bingo/vi-vn/%3A6606:1250
pg55.bingo/vi-vn/%3A6606:5126
pg55.bingo/vi-vn/%3A6606:4738
pg55.bingo/vi-vn/%3A6606:7097
pg55.bingo/vi-vn/%3A6606:8235
pg55.bingo/vi-vn/%3A2048:4441
pg55.bingo/vi-vn/%3A2048:1756
pg55.bingo/vi-vn/%3A2048:1250
pg55.bingo/vi-vn/%3A2048:5126
pg55.bingo/vi-vn/%3A2048:4738
pg55.bingo/vi-vn/%3A2048:7097
pg55.bingo/vi-vn/%3A2048:8235
pg55.bingo/vi-vn/%3A9758:4441
pg55.bingo/vi-vn/%3A9758:1756
pg55.bingo/vi-vn/%3A9758:1250
pg55.bingo/vi-vn/%3A9758:5126
pg55.bingo/vi-vn/%3A9758:4738
pg55.bingo/vi-vn/%3A9758:7097
pg55.bingo/vi-vn/%3A9758:8235

Mutex

uh4t919asRaF

Attributes

delay
3
install
true
install_file
pg55bingo.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  538ad8e4-e932-4a38-8a1f-eb7af19157e4.exe
- Size 46KB
- SHA256 f9ce4f07f13cb5a2f30bf782833d91ed4c352e89543ff40bbe975162d73e6c4a
- MD5 3df194c7b40b81fe15116956ee15e0d2
- SHA1 89b32ff2b60d925e0caac0460114baa98ae5749b
- SHA512 159b56f8430b75766dbc6b3399575adcfa6c7669a41529b8d0d27cbd74573d7ca64cca42aad2a68beae238582b4388de09f2b6e7e39b329e6335122ae26c374e
- SSDEEP 768:Qak0CLeA7rxvFwJGEx8T72hA9w1PKJIjb6g4ZFf4XDYrvBZ/8oNmM5bGf+R:Qak0CJdv3SKKbt4TfQYVZ/eM5bGf+R
- TLSH
  T1F52329007BED822AF2BE9F7899F2224546B9F2532603D5491C8812DB5613FC1CB426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2