asyncrat | fc108b2e081de2960c2230e8acabb879d3eb4a11bd60001b0567eae1139bf515

Sharing

Copy URL Twitter E-mail

General

Target
fc108b2e081de2960c2230e8acabb879d3eb4a11bd60001b0567eae1139bf515
Size 45KB
Sample260720-vxkdzshv2q
SHA256 fc108b2e081de2960c2230e8acabb879d3eb4a11bd60001b0567eae1139bf515
MD5 89d0521797172f557a36170cb87be040
SHA1 f3447b71011546178d05f38aaf796331383844b8
SHA512 3ed2a4150f2113b89eb5d1ac35aef4dce0c52a0a108522ae6489d6e77468ddf2d2161de726ba94ac1cc0ba9482c8862c0b6b4f5336372a674249ea3a3ee33b85
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYsHO9YjoHPICYzjb5gX3iwbGllG6XLr8PoSkmBDZ0x:8uuSpTgyf2h6kgCY3bWXSw1ULrCorod2
TLSH
T128231A003BE8C12BF2BE4F78A9F26145867EF6633603D5891CC451DB5623FC69A426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
shamoon.kacasatu.com:80
shamoon.kacasatu.com:22
shamoon.kacasatu.com:8080
shamoon.kacasatu.com:8880
shamoon.kacasatu.com:2052
shamoon.kacasatu.com:2082
shamoon.kacasatu.com:2086
shamoon.kacasatu.com:2095
shamoon.kacasatu.com:443
shamoon.kacasatu.com:2053
shamoon.kacasatu.com:2083
shamoon.kacasatu.com:2087
shamoon.kacasatu.com:2096
shamoon.kacasatu.com:8443
remote.kacasatu.com:80
remote.kacasatu.com:22
remote.kacasatu.com:8080
remote.kacasatu.com:8880
remote.kacasatu.com:2052
remote.kacasatu.com:2082
remote.kacasatu.com:2086
remote.kacasatu.com:2095
remote.kacasatu.com:443
remote.kacasatu.com:2053
remote.kacasatu.com:2083
remote.kacasatu.com:2087
remote.kacasatu.com:2096
remote.kacasatu.com:8443
agenttesla.kacasatu.com:80
agenttesla.kacasatu.com:22
agenttesla.kacasatu.com:8080
agenttesla.kacasatu.com:8880
agenttesla.kacasatu.com:2052
agenttesla.kacasatu.com:2082
agenttesla.kacasatu.com:2086
agenttesla.kacasatu.com:2095
agenttesla.kacasatu.com:443
agenttesla.kacasatu.com:2053
agenttesla.kacasatu.com:2083
agenttesla.kacasatu.com:2087
agenttesla.kacasatu.com:2096
agenttesla.kacasatu.com:8443
cl0p.kacasatu.com:80
cl0p.kacasatu.com:22
cl0p.kacasatu.com:8080
cl0p.kacasatu.com:8880
cl0p.kacasatu.com:2052
cl0p.kacasatu.com:2082
cl0p.kacasatu.com:2086
cl0p.kacasatu.com:2095
cl0p.kacasatu.com:443
cl0p.kacasatu.com:2053
cl0p.kacasatu.com:2083
cl0p.kacasatu.com:2087
cl0p.kacasatu.com:2096
cl0p.kacasatu.com:8443

Mutex

OOA5damscXvj

Attributes

delay
0
install
true
install_file
12f8lz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  fc108b2e081de2960c2230e8acabb879d3eb4a11bd60001b0567eae1139bf515
- Size 45KB
- SHA256 fc108b2e081de2960c2230e8acabb879d3eb4a11bd60001b0567eae1139bf515
- MD5 89d0521797172f557a36170cb87be040
- SHA1 f3447b71011546178d05f38aaf796331383844b8
- SHA512 3ed2a4150f2113b89eb5d1ac35aef4dce0c52a0a108522ae6489d6e77468ddf2d2161de726ba94ac1cc0ba9482c8862c0b6b4f5336372a674249ea3a3ee33b85
- SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYsHO9YjoHPICYzjb5gX3iwbGllG6XLr8PoSkmBDZ0x:8uuSpTgyf2h6kgCY3bWXSw1ULrCorod2
- TLSH
  T128231A003BE8C12BF2BE4F78A9F26145867EF6633603D5891CC451DB5623FC69A426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2