asyncrat | 84f16f5a7da312f1c03cb34aac5ce0dcd69572bf7f5da468f303efe4b71175e9

Sharing

Copy URL Twitter E-mail

General

Target
9950e4ab-29ca-48a9-bbad-37f4663ff7a7.exe
Size 46KB
Sample260831-bxyf3aec56
SHA256 84f16f5a7da312f1c03cb34aac5ce0dcd69572bf7f5da468f303efe4b71175e9
MD5 5580209f6afab21a57e8b9126bb006d2
SHA1 6690ef2283a1659801a615fb78e20eea66a35739
SHA512 e723b8f1a5e44cd17e5418be636c6670b69021055a58e70c60fa4cad07c28fe50d219ee226cb17a9f65a6477530fe3baba48f1d6d5123e67c99cf01bd025adad
SSDEEP 768:3as8ULrYWETxvtwZGmx8szahx50F01PW7IjbKg47F/tt46gTOeqe4EpE8mM5b9fU:3as8U/JexVnWMbd4h/ty68O64EmBM5bW
TLSH
T1C3232B003BED812AF2BE4F7499F3225582BAF6633603D95D1C8812D65713FC5CA426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

pg55.enterprises:5252
pg55.enterprises:3501
pg55.enterprises:7313
pg55.enterprises:4074
pg55.enterprises:5987
www.pg55.enterprises:5252
www.pg55.enterprises:3501
www.pg55.enterprises:7313
www.pg55.enterprises:4074
www.pg55.enterprises:5987
NotPetya.pg55.enterprises:5252
NotPetya.pg55.enterprises:3501
NotPetya.pg55.enterprises:7313
NotPetya.pg55.enterprises:4074
NotPetya.pg55.enterprises:5987
Stuxnet.pg55.enterprises:5252
Stuxnet.pg55.enterprises:3501
Stuxnet.pg55.enterprises:7313
Stuxnet.pg55.enterprises:4074
Stuxnet.pg55.enterprises:5987
Zeus.pg55.enterprises:5252
Zeus.pg55.enterprises:3501
Zeus.pg55.enterprises:7313
Zeus.pg55.enterprises:4074
Zeus.pg55.enterprises:5987
CryptoLocker.pg55.enterprises:5252
CryptoLocker.pg55.enterprises:3501
CryptoLocker.pg55.enterprises:7313
CryptoLocker.pg55.enterprises:4074
CryptoLocker.pg55.enterprises:5987
pg55.enterprises/vi-vn/%3A8178:5252
pg55.enterprises/vi-vn/%3A8178:3501
pg55.enterprises/vi-vn/%3A8178:7313
pg55.enterprises/vi-vn/%3A8178:4074
pg55.enterprises/vi-vn/%3A8178:5987
pg55.enterprises/vi-vn/%3A5832:5252
pg55.enterprises/vi-vn/%3A5832:3501
pg55.enterprises/vi-vn/%3A5832:7313
pg55.enterprises/vi-vn/%3A5832:4074
pg55.enterprises/vi-vn/%3A5832:5987
pg55.enterprises/vi-vn/%3A1777:5252
pg55.enterprises/vi-vn/%3A1777:3501
pg55.enterprises/vi-vn/%3A1777:7313
pg55.enterprises/vi-vn/%3A1777:4074
pg55.enterprises/vi-vn/%3A1777:5987
pg55.enterprises/vi-vn/%3A0484:5252
pg55.enterprises/vi-vn/%3A0484:3501
pg55.enterprises/vi-vn/%3A0484:7313
pg55.enterprises/vi-vn/%3A0484:4074
pg55.enterprises/vi-vn/%3A0484:5987
pg55.enterprises/vi-vn/%3A8023:5252
pg55.enterprises/vi-vn/%3A8023:3501
pg55.enterprises/vi-vn/%3A8023:7313
pg55.enterprises/vi-vn/%3A8023:4074
pg55.enterprises/vi-vn/%3A8023:5987
pg55.enterprises/vi-vn/%3A0285:5252
pg55.enterprises/vi-vn/%3A0285:3501
pg55.enterprises/vi-vn/%3A0285:7313
pg55.enterprises/vi-vn/%3A0285:4074
pg55.enterprises/vi-vn/%3A0285:5987
pg55.enterprises/vi-vn/%3A8613:5252
pg55.enterprises/vi-vn/%3A8613:3501
pg55.enterprises/vi-vn/%3A8613:7313
pg55.enterprises/vi-vn/%3A8613:4074
pg55.enterprises/vi-vn/%3A8613:5987

Mutex

XxVUBsHd4lhl

Attributes

delay
3
install
true
install_file
pg55a.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  9950e4ab-29ca-48a9-bbad-37f4663ff7a7.exe
- Size 46KB
- SHA256 84f16f5a7da312f1c03cb34aac5ce0dcd69572bf7f5da468f303efe4b71175e9
- MD5 5580209f6afab21a57e8b9126bb006d2
- SHA1 6690ef2283a1659801a615fb78e20eea66a35739
- SHA512 e723b8f1a5e44cd17e5418be636c6670b69021055a58e70c60fa4cad07c28fe50d219ee226cb17a9f65a6477530fe3baba48f1d6d5123e67c99cf01bd025adad
- SSDEEP 768:3as8ULrYWETxvtwZGmx8szahx50F01PW7IjbKg47F/tt46gTOeqe4EpE8mM5b9fU:3as8U/JexVnWMbd4h/ty68O64EmBM5bW
- TLSH
  T1C3232B003BED812AF2BE4F7499F3225582BAF6633603D95D1C8812D65713FC5CA426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2