asyncrat | 9a0b5f779419685a54d72e2c84ce51f18f0f35529d1b09b71397d61359e1213b

Sharing

Copy URL Twitter E-mail

General

Target
7a84643f-162a-40cb-b5ee-ff8667dd2736.exe
Size 46KB
Sample260804-ppt1kawycv
SHA256 9a0b5f779419685a54d72e2c84ce51f18f0f35529d1b09b71397d61359e1213b
MD5 501d0838253f956877901ea8dff736cf
SHA1 2c9e73472c06b74b7c0dae24fad21eabfc118e96
SHA512 cc7f1e237af30c2508dcff0eed4d737dfd24e2820e72c0089e15344c2a62b966c3e222fd31bcd55486c10967971eed6a3f98649a74fe56b295342fb000ef9511
SSDEEP 768:Qak0CLeA7rxvFwJGEx8T72hA9w1PKJIjb6g4ZFf4XDYrvBZ/8oNmM5bGf+7:Qak0CJdv3SKKbt4TfQYVZ/eM5bGf+7
TLSH
T1F52329007BED822AF2BE9F7899F2224546B9F2532603D54D1C8812DB5613FC5CB426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

pg55.bingo:4441
pg55.bingo:1756
pg55.bingo:1250
pg55.bingo:5126
pg55.bingo:4738
pg55.bingo:7097
pg55.bingo:8235
www.pg55.bingo:4441
www.pg55.bingo:1756
www.pg55.bingo:1250
www.pg55.bingo:5126
www.pg55.bingo:4738
www.pg55.bingo:7097
www.pg55.bingo:8235
NotPetya.pg55.bingo:4441
NotPetya.pg55.bingo:1756
NotPetya.pg55.bingo:1250
NotPetya.pg55.bingo:5126
NotPetya.pg55.bingo:4738
NotPetya.pg55.bingo:7097
NotPetya.pg55.bingo:8235
Stuxnet.pg55.bingo:4441
Stuxnet.pg55.bingo:1756
Stuxnet.pg55.bingo:1250
Stuxnet.pg55.bingo:5126
Stuxnet.pg55.bingo:4738
Stuxnet.pg55.bingo:7097
Stuxnet.pg55.bingo:8235
Zeus.pg55.bingo:4441
Zeus.pg55.bingo:1756
Zeus.pg55.bingo:1250
Zeus.pg55.bingo:5126
Zeus.pg55.bingo:4738
Zeus.pg55.bingo:7097
Zeus.pg55.bingo:8235
CryptoLocker.pg55.bingo:4441
CryptoLocker.pg55.bingo:1756
CryptoLocker.pg55.bingo:1250
CryptoLocker.pg55.bingo:5126
CryptoLocker.pg55.bingo:4738
CryptoLocker.pg55.bingo:7097
CryptoLocker.pg55.bingo:8235
pg55.bingo/vi-vn/%3A8405:4441
pg55.bingo/vi-vn/%3A8405:1756
pg55.bingo/vi-vn/%3A8405:1250
pg55.bingo/vi-vn/%3A8405:5126
pg55.bingo/vi-vn/%3A8405:4738
pg55.bingo/vi-vn/%3A8405:7097
pg55.bingo/vi-vn/%3A8405:8235
pg55.bingo/vi-vn/%3A1968:4441
pg55.bingo/vi-vn/%3A1968:1756
pg55.bingo/vi-vn/%3A1968:1250
pg55.bingo/vi-vn/%3A1968:5126
pg55.bingo/vi-vn/%3A1968:4738
pg55.bingo/vi-vn/%3A1968:7097
pg55.bingo/vi-vn/%3A1968:8235
pg55.bingo/vi-vn/%3A8121:4441
pg55.bingo/vi-vn/%3A8121:1756
pg55.bingo/vi-vn/%3A8121:1250
pg55.bingo/vi-vn/%3A8121:5126
pg55.bingo/vi-vn/%3A8121:4738
pg55.bingo/vi-vn/%3A8121:7097
pg55.bingo/vi-vn/%3A8121:8235
pg55.bingo/vi-vn/%3A7513:4441
pg55.bingo/vi-vn/%3A7513:1756
pg55.bingo/vi-vn/%3A7513:1250
pg55.bingo/vi-vn/%3A7513:5126
pg55.bingo/vi-vn/%3A7513:4738
pg55.bingo/vi-vn/%3A7513:7097
pg55.bingo/vi-vn/%3A7513:8235
pg55.bingo/vi-vn/%3A6606:4441
pg55.bingo/vi-vn/%3A6606:1756
pg55.bingo/vi-vn/%3A6606:1250
pg55.bingo/vi-vn/%3A6606:5126
pg55.bingo/vi-vn/%3A6606:4738
pg55.bingo/vi-vn/%3A6606:7097
pg55.bingo/vi-vn/%3A6606:8235
pg55.bingo/vi-vn/%3A2048:4441
pg55.bingo/vi-vn/%3A2048:1756
pg55.bingo/vi-vn/%3A2048:1250
pg55.bingo/vi-vn/%3A2048:5126
pg55.bingo/vi-vn/%3A2048:4738
pg55.bingo/vi-vn/%3A2048:7097
pg55.bingo/vi-vn/%3A2048:8235
pg55.bingo/vi-vn/%3A9758:4441
pg55.bingo/vi-vn/%3A9758:1756
pg55.bingo/vi-vn/%3A9758:1250
pg55.bingo/vi-vn/%3A9758:5126
pg55.bingo/vi-vn/%3A9758:4738
pg55.bingo/vi-vn/%3A9758:7097
pg55.bingo/vi-vn/%3A9758:8235

Mutex

uh4t919asRaF

Attributes

delay
3
install
true
install_file
pg55bingo.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  7a84643f-162a-40cb-b5ee-ff8667dd2736.exe
- Size 46KB
- SHA256 9a0b5f779419685a54d72e2c84ce51f18f0f35529d1b09b71397d61359e1213b
- MD5 501d0838253f956877901ea8dff736cf
- SHA1 2c9e73472c06b74b7c0dae24fad21eabfc118e96
- SHA512 cc7f1e237af30c2508dcff0eed4d737dfd24e2820e72c0089e15344c2a62b966c3e222fd31bcd55486c10967971eed6a3f98649a74fe56b295342fb000ef9511
- SSDEEP 768:Qak0CLeA7rxvFwJGEx8T72hA9w1PKJIjb6g4ZFf4XDYrvBZ/8oNmM5bGf+7:Qak0CJdv3SKKbt4TfQYVZ/eM5bGf+7
- TLSH
  T1F52329007BED822AF2BE9F7899F2224546B9F2532603D54D1C8812DB5613FC5CB426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2