asyncrat | a5553d3b8f6ca29c780241d49ee5c4271a157bf0d5c992894bcee64af0c11a2d

Sharing

Copy URL Twitter E-mail

General

Target
a5553d3b8f6ca29c780241d49ee5c4271a157bf0d5c992894bcee64af0c11a2d
Size 45KB
Sample260720-svrdeaev6q
SHA256 a5553d3b8f6ca29c780241d49ee5c4271a157bf0d5c992894bcee64af0c11a2d
MD5 1674d430fa785c111b3180b2da25edec
SHA1 091064d14ea848ebb84bd0b45c0c5bfd7010bf47
SHA512 884dff76a8eacb796c800854de06d8a0c94357d3e211e8e1dc49affe10555c897a1bde1420d58952bf74497f3f41018829db6d2c4837bb09bf181ec0605960cc
SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4b9oS0qHzNOPIYzjbMg73i/kXiyNp0aT7h/BDZ0x:8uUIpT4vAj2fa1q3Y3bD7SMXizaDd0x
TLSH
T18F232A003BE9C12BF2BF5F7899F26105867AB6633603D64A1CC451DB5613FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
cl0p.kacasatu.com:80
cl0p.kacasatu.com:22
cl0p.kacasatu.com:8080
cl0p.kacasatu.com:8880
cl0p.kacasatu.com:2052
cl0p.kacasatu.com:2082
cl0p.kacasatu.com:2086
cl0p.kacasatu.com:2095
cl0p.kacasatu.com:443
cl0p.kacasatu.com:2053
cl0p.kacasatu.com:2083
cl0p.kacasatu.com:2087
cl0p.kacasatu.com:2096
cl0p.kacasatu.com:8443
remote.kacasatu.com:80
remote.kacasatu.com:22
remote.kacasatu.com:8080
remote.kacasatu.com:8880
remote.kacasatu.com:2052
remote.kacasatu.com:2082
remote.kacasatu.com:2086
remote.kacasatu.com:2095
remote.kacasatu.com:443
remote.kacasatu.com:2053
remote.kacasatu.com:2083
remote.kacasatu.com:2087
remote.kacasatu.com:2096
remote.kacasatu.com:8443
darkside.kacasatu.com:80
darkside.kacasatu.com:22
darkside.kacasatu.com:8080
darkside.kacasatu.com:8880
darkside.kacasatu.com:2052
darkside.kacasatu.com:2082
darkside.kacasatu.com:2086
darkside.kacasatu.com:2095
darkside.kacasatu.com:443
darkside.kacasatu.com:2053
darkside.kacasatu.com:2083
darkside.kacasatu.com:2087
darkside.kacasatu.com:2096
darkside.kacasatu.com:8443
blacklotus.kacasatu.com:80
blacklotus.kacasatu.com:22
blacklotus.kacasatu.com:8080
blacklotus.kacasatu.com:8880
blacklotus.kacasatu.com:2052
blacklotus.kacasatu.com:2082
blacklotus.kacasatu.com:2086
blacklotus.kacasatu.com:2095
blacklotus.kacasatu.com:443
blacklotus.kacasatu.com:2053
blacklotus.kacasatu.com:2083
blacklotus.kacasatu.com:2087
blacklotus.kacasatu.com:2096
blacklotus.kacasatu.com:8443

Mutex

qpoLseqa2DXF

Attributes

delay
0
install
true
install_file
00fjlll.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a5553d3b8f6ca29c780241d49ee5c4271a157bf0d5c992894bcee64af0c11a2d
- Size 45KB
- SHA256 a5553d3b8f6ca29c780241d49ee5c4271a157bf0d5c992894bcee64af0c11a2d
- MD5 1674d430fa785c111b3180b2da25edec
- SHA1 091064d14ea848ebb84bd0b45c0c5bfd7010bf47
- SHA512 884dff76a8eacb796c800854de06d8a0c94357d3e211e8e1dc49affe10555c897a1bde1420d58952bf74497f3f41018829db6d2c4837bb09bf181ec0605960cc
- SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4b9oS0qHzNOPIYzjbMg73i/kXiyNp0aT7h/BDZ0x:8uUIpT4vAj2fa1q3Y3bD7SMXizaDd0x
- TLSH
  T18F232A003BE9C12BF2BF5F7899F26105867AB6633603D64A1CC451DB5613FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2