asyncrat | 5f3e37db778fd4df8df3acfb6e0779a07bac8fc906ef73f4615966835bfcf854

Sharing

Copy URL Twitter E-mail

General

Target
5f3e37db778fd4df8df3acfb6e0779a07bac8fc906ef73f4615966835bfcf854
Size 45KB
Sample260720-xa22mabz2r
SHA256 5f3e37db778fd4df8df3acfb6e0779a07bac8fc906ef73f4615966835bfcf854
MD5 47c7e9d845a5c9b3426284d877edaf83
SHA1 3d627770e0aa7d7355a16ed7e5852ea19b948f36
SHA512 6cb788f264d2fc0825611503a1ff71786321e8e1f73b737e9ba194c090666649009d02623bbd82f14d93c7f78f3f54c5dc315666ae7f5d983e29b7052fbe125e
SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPclm3API7zjb3gX3iSIFPwT4KYhYA3BDZkx:suJdpTPdI2HfcE3l73bQXSSIdwPC9dkx
TLSH
T143231A003BE8812BF2BE4F78A8F26145467AF5737603D64A1CC4529B5723FC6DA426ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
conficker.kacasatu.com:80
conficker.kacasatu.com:22
conficker.kacasatu.com:8080
conficker.kacasatu.com:8880
conficker.kacasatu.com:2052
conficker.kacasatu.com:2082
conficker.kacasatu.com:2086
conficker.kacasatu.com:2095
conficker.kacasatu.com:443
conficker.kacasatu.com:2053
conficker.kacasatu.com:2083
conficker.kacasatu.com:2087
conficker.kacasatu.com:2096
conficker.kacasatu.com:8443
nimda.kacasatu.com:80
nimda.kacasatu.com:22
nimda.kacasatu.com:8080
nimda.kacasatu.com:8880
nimda.kacasatu.com:2052
nimda.kacasatu.com:2082
nimda.kacasatu.com:2086
nimda.kacasatu.com:2095
nimda.kacasatu.com:443
nimda.kacasatu.com:2053
nimda.kacasatu.com:2083
nimda.kacasatu.com:2087
nimda.kacasatu.com:2096
nimda.kacasatu.com:8443
invasive.kacasatu.com:80
invasive.kacasatu.com:22
invasive.kacasatu.com:8080
invasive.kacasatu.com:8880
invasive.kacasatu.com:2052
invasive.kacasatu.com:2082
invasive.kacasatu.com:2086
invasive.kacasatu.com:2095
invasive.kacasatu.com:443
invasive.kacasatu.com:2053
invasive.kacasatu.com:2083
invasive.kacasatu.com:2087
invasive.kacasatu.com:2096
invasive.kacasatu.com:8443

Mutex

ziA1ldlFDmWF

Attributes

delay
0
install
true
install_file
oibao86w.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5f3e37db778fd4df8df3acfb6e0779a07bac8fc906ef73f4615966835bfcf854
- Size 45KB
- SHA256 5f3e37db778fd4df8df3acfb6e0779a07bac8fc906ef73f4615966835bfcf854
- MD5 47c7e9d845a5c9b3426284d877edaf83
- SHA1 3d627770e0aa7d7355a16ed7e5852ea19b948f36
- SHA512 6cb788f264d2fc0825611503a1ff71786321e8e1f73b737e9ba194c090666649009d02623bbd82f14d93c7f78f3f54c5dc315666ae7f5d983e29b7052fbe125e
- SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPclm3API7zjb3gX3iSIFPwT4KYhYA3BDZkx:suJdpTPdI2HfcE3l73bQXSSIdwPC9dkx
- TLSH
  T143231A003BE8812BF2BE4F78A8F26145467AF5737603D64A1CC4529B5723FC6DA426ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2