asyncrat | c636b79af44f2769c2a540e09f6366e9f634450c87f8f708281fb1bff2058654

Sharing

Copy URL Twitter E-mail

General

Target
797e5c4a-219b-4277-b7d7-8624bb0fc36b.exe
Size 46KB
Sample260804-pptd2awyb1
SHA256 c636b79af44f2769c2a540e09f6366e9f634450c87f8f708281fb1bff2058654
MD5 565850d096c5f59dcb0c9860938b7e77
SHA1 b89912aee5a179eef97b7b914a37999a33667957
SHA512 6dcb73e069d20324ae413ea1e8cfc50fdba887f2343b8c4799fbc45514ecc73d60a14dbe141a7371a26833860b6ba69ff9f9049c00d778c506e135bbccf83a47
SSDEEP 768:Qak0CLeA7rxvFwJGEx8T72hA9w1PKJIjb6g4ZFf4XDYrvBZ/8oNmM5bGf+w:Qak0CJdv3SKKbt4TfQYVZ/eM5bGf+w
TLSH
T1022329007BED822AF2BE9F7899F2624546B9F6532603D54D1C8812DB5613FC1CB426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

pg55.bingo:4441
pg55.bingo:1756
pg55.bingo:1250
pg55.bingo:5126
pg55.bingo:4738
pg55.bingo:7097
pg55.bingo:8235
www.pg55.bingo:4441
www.pg55.bingo:1756
www.pg55.bingo:1250
www.pg55.bingo:5126
www.pg55.bingo:4738
www.pg55.bingo:7097
www.pg55.bingo:8235
NotPetya.pg55.bingo:4441
NotPetya.pg55.bingo:1756
NotPetya.pg55.bingo:1250
NotPetya.pg55.bingo:5126
NotPetya.pg55.bingo:4738
NotPetya.pg55.bingo:7097
NotPetya.pg55.bingo:8235
Stuxnet.pg55.bingo:4441
Stuxnet.pg55.bingo:1756
Stuxnet.pg55.bingo:1250
Stuxnet.pg55.bingo:5126
Stuxnet.pg55.bingo:4738
Stuxnet.pg55.bingo:7097
Stuxnet.pg55.bingo:8235
Zeus.pg55.bingo:4441
Zeus.pg55.bingo:1756
Zeus.pg55.bingo:1250
Zeus.pg55.bingo:5126
Zeus.pg55.bingo:4738
Zeus.pg55.bingo:7097
Zeus.pg55.bingo:8235
CryptoLocker.pg55.bingo:4441
CryptoLocker.pg55.bingo:1756
CryptoLocker.pg55.bingo:1250
CryptoLocker.pg55.bingo:5126
CryptoLocker.pg55.bingo:4738
CryptoLocker.pg55.bingo:7097
CryptoLocker.pg55.bingo:8235
pg55.bingo/vi-vn/%3A8405:4441
pg55.bingo/vi-vn/%3A8405:1756
pg55.bingo/vi-vn/%3A8405:1250
pg55.bingo/vi-vn/%3A8405:5126
pg55.bingo/vi-vn/%3A8405:4738
pg55.bingo/vi-vn/%3A8405:7097
pg55.bingo/vi-vn/%3A8405:8235
pg55.bingo/vi-vn/%3A1968:4441
pg55.bingo/vi-vn/%3A1968:1756
pg55.bingo/vi-vn/%3A1968:1250
pg55.bingo/vi-vn/%3A1968:5126
pg55.bingo/vi-vn/%3A1968:4738
pg55.bingo/vi-vn/%3A1968:7097
pg55.bingo/vi-vn/%3A1968:8235
pg55.bingo/vi-vn/%3A8121:4441
pg55.bingo/vi-vn/%3A8121:1756
pg55.bingo/vi-vn/%3A8121:1250
pg55.bingo/vi-vn/%3A8121:5126
pg55.bingo/vi-vn/%3A8121:4738
pg55.bingo/vi-vn/%3A8121:7097
pg55.bingo/vi-vn/%3A8121:8235
pg55.bingo/vi-vn/%3A7513:4441
pg55.bingo/vi-vn/%3A7513:1756
pg55.bingo/vi-vn/%3A7513:1250
pg55.bingo/vi-vn/%3A7513:5126
pg55.bingo/vi-vn/%3A7513:4738
pg55.bingo/vi-vn/%3A7513:7097
pg55.bingo/vi-vn/%3A7513:8235
pg55.bingo/vi-vn/%3A6606:4441
pg55.bingo/vi-vn/%3A6606:1756
pg55.bingo/vi-vn/%3A6606:1250
pg55.bingo/vi-vn/%3A6606:5126
pg55.bingo/vi-vn/%3A6606:4738
pg55.bingo/vi-vn/%3A6606:7097
pg55.bingo/vi-vn/%3A6606:8235
pg55.bingo/vi-vn/%3A2048:4441
pg55.bingo/vi-vn/%3A2048:1756
pg55.bingo/vi-vn/%3A2048:1250
pg55.bingo/vi-vn/%3A2048:5126
pg55.bingo/vi-vn/%3A2048:4738
pg55.bingo/vi-vn/%3A2048:7097
pg55.bingo/vi-vn/%3A2048:8235
pg55.bingo/vi-vn/%3A9758:4441
pg55.bingo/vi-vn/%3A9758:1756
pg55.bingo/vi-vn/%3A9758:1250
pg55.bingo/vi-vn/%3A9758:5126
pg55.bingo/vi-vn/%3A9758:4738
pg55.bingo/vi-vn/%3A9758:7097
pg55.bingo/vi-vn/%3A9758:8235

Mutex

uh4t919asRaF

Attributes

delay
3
install
true
install_file
pg55bingo.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  797e5c4a-219b-4277-b7d7-8624bb0fc36b.exe
- Size 46KB
- SHA256 c636b79af44f2769c2a540e09f6366e9f634450c87f8f708281fb1bff2058654
- MD5 565850d096c5f59dcb0c9860938b7e77
- SHA1 b89912aee5a179eef97b7b914a37999a33667957
- SHA512 6dcb73e069d20324ae413ea1e8cfc50fdba887f2343b8c4799fbc45514ecc73d60a14dbe141a7371a26833860b6ba69ff9f9049c00d778c506e135bbccf83a47
- SSDEEP 768:Qak0CLeA7rxvFwJGEx8T72hA9w1PKJIjb6g4ZFf4XDYrvBZ/8oNmM5bGf+w:Qak0CJdv3SKKbt4TfQYVZ/eM5bGf+w
- TLSH
  T1022329007BED822AF2BE9F7899F2624546B9F6532603D54D1C8812DB5613FC1CB426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2