asyncrat | 05da2ec34f0c9a8dbf310881d570f79ea6cabb4cf7e14e20b0a3e0a360693424

Sharing

Copy URL Twitter E-mail

General

Target
dfb628a8-48c9-401d-8152-5d42c4e6315a.exe
Size 46KB
Sample260804-ppvl4awycx
SHA256 05da2ec34f0c9a8dbf310881d570f79ea6cabb4cf7e14e20b0a3e0a360693424
MD5 c627cf58d94e890cf607e8c4bb3b0bf3
SHA1 2b2c0163c86107a7756b71faffbd26bf3f6c0670
SHA512 6b8227f16c89e167462753fbaf71ee398cbcabfe12b963de82d022a41fed96e407ac08cf1b9a1e5892855d0a4cf8d01e00a72d99bf6846eef38c29d9e2b170a0
SSDEEP 768:Qak0CLeA7rxvFwJGEx8T72hA9w1PKJIjb6g4ZFf4XDYrvBZ/8oNmM5bGf+I:Qak0CJdv3SKKbt4TfQYVZ/eM5bGf+I
TLSH
T1882329007BED822AF2BE9F7899F2624546B9F2532603D54D1C8812DB5613FC1CB426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

pg55.bingo:4441
pg55.bingo:1756
pg55.bingo:1250
pg55.bingo:5126
pg55.bingo:4738
pg55.bingo:7097
pg55.bingo:8235
www.pg55.bingo:4441
www.pg55.bingo:1756
www.pg55.bingo:1250
www.pg55.bingo:5126
www.pg55.bingo:4738
www.pg55.bingo:7097
www.pg55.bingo:8235
NotPetya.pg55.bingo:4441
NotPetya.pg55.bingo:1756
NotPetya.pg55.bingo:1250
NotPetya.pg55.bingo:5126
NotPetya.pg55.bingo:4738
NotPetya.pg55.bingo:7097
NotPetya.pg55.bingo:8235
Stuxnet.pg55.bingo:4441
Stuxnet.pg55.bingo:1756
Stuxnet.pg55.bingo:1250
Stuxnet.pg55.bingo:5126
Stuxnet.pg55.bingo:4738
Stuxnet.pg55.bingo:7097
Stuxnet.pg55.bingo:8235
Zeus.pg55.bingo:4441
Zeus.pg55.bingo:1756
Zeus.pg55.bingo:1250
Zeus.pg55.bingo:5126
Zeus.pg55.bingo:4738
Zeus.pg55.bingo:7097
Zeus.pg55.bingo:8235
CryptoLocker.pg55.bingo:4441
CryptoLocker.pg55.bingo:1756
CryptoLocker.pg55.bingo:1250
CryptoLocker.pg55.bingo:5126
CryptoLocker.pg55.bingo:4738
CryptoLocker.pg55.bingo:7097
CryptoLocker.pg55.bingo:8235
pg55.bingo/vi-vn/%3A8405:4441
pg55.bingo/vi-vn/%3A8405:1756
pg55.bingo/vi-vn/%3A8405:1250
pg55.bingo/vi-vn/%3A8405:5126
pg55.bingo/vi-vn/%3A8405:4738
pg55.bingo/vi-vn/%3A8405:7097
pg55.bingo/vi-vn/%3A8405:8235
pg55.bingo/vi-vn/%3A1968:4441
pg55.bingo/vi-vn/%3A1968:1756
pg55.bingo/vi-vn/%3A1968:1250
pg55.bingo/vi-vn/%3A1968:5126
pg55.bingo/vi-vn/%3A1968:4738
pg55.bingo/vi-vn/%3A1968:7097
pg55.bingo/vi-vn/%3A1968:8235
pg55.bingo/vi-vn/%3A8121:4441
pg55.bingo/vi-vn/%3A8121:1756
pg55.bingo/vi-vn/%3A8121:1250
pg55.bingo/vi-vn/%3A8121:5126
pg55.bingo/vi-vn/%3A8121:4738
pg55.bingo/vi-vn/%3A8121:7097
pg55.bingo/vi-vn/%3A8121:8235
pg55.bingo/vi-vn/%3A7513:4441
pg55.bingo/vi-vn/%3A7513:1756
pg55.bingo/vi-vn/%3A7513:1250
pg55.bingo/vi-vn/%3A7513:5126
pg55.bingo/vi-vn/%3A7513:4738
pg55.bingo/vi-vn/%3A7513:7097
pg55.bingo/vi-vn/%3A7513:8235
pg55.bingo/vi-vn/%3A6606:4441
pg55.bingo/vi-vn/%3A6606:1756
pg55.bingo/vi-vn/%3A6606:1250
pg55.bingo/vi-vn/%3A6606:5126
pg55.bingo/vi-vn/%3A6606:4738
pg55.bingo/vi-vn/%3A6606:7097
pg55.bingo/vi-vn/%3A6606:8235
pg55.bingo/vi-vn/%3A2048:4441
pg55.bingo/vi-vn/%3A2048:1756
pg55.bingo/vi-vn/%3A2048:1250
pg55.bingo/vi-vn/%3A2048:5126
pg55.bingo/vi-vn/%3A2048:4738
pg55.bingo/vi-vn/%3A2048:7097
pg55.bingo/vi-vn/%3A2048:8235
pg55.bingo/vi-vn/%3A9758:4441
pg55.bingo/vi-vn/%3A9758:1756
pg55.bingo/vi-vn/%3A9758:1250
pg55.bingo/vi-vn/%3A9758:5126
pg55.bingo/vi-vn/%3A9758:4738
pg55.bingo/vi-vn/%3A9758:7097
pg55.bingo/vi-vn/%3A9758:8235

Mutex

uh4t919asRaF

Attributes

delay
3
install
true
install_file
pg55bingo.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  dfb628a8-48c9-401d-8152-5d42c4e6315a.exe
- Size 46KB
- SHA256 05da2ec34f0c9a8dbf310881d570f79ea6cabb4cf7e14e20b0a3e0a360693424
- MD5 c627cf58d94e890cf607e8c4bb3b0bf3
- SHA1 2b2c0163c86107a7756b71faffbd26bf3f6c0670
- SHA512 6b8227f16c89e167462753fbaf71ee398cbcabfe12b963de82d022a41fed96e407ac08cf1b9a1e5892855d0a4cf8d01e00a72d99bf6846eef38c29d9e2b170a0
- SSDEEP 768:Qak0CLeA7rxvFwJGEx8T72hA9w1PKJIjb6g4ZFf4XDYrvBZ/8oNmM5bGf+I:Qak0CJdv3SKKbt4TfQYVZ/eM5bGf+I
- TLSH
  T1882329007BED822AF2BE9F7899F2624546B9F2532603D54D1C8812DB5613FC1CB426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2