asyncrat | 4ff1914a23cf84dcf342ac28a2c32e6685c3b4081891f8c1469bd420308282e4

Sharing

Copy URL Twitter E-mail

General

Target
4ff1914a23cf84dcf342ac28a2c32e6685c3b4081891f8c1469bd420308282e4
Size 45KB
Sample260721-phktbahc82
SHA256 4ff1914a23cf84dcf342ac28a2c32e6685c3b4081891f8c1469bd420308282e4
MD5 95121fe50e9532274bf7f5c0f17fb6e7
SHA1 2458919b0edc26e9b2d1184a331cee822afe1b73
SHA512 7e46bda777cf1f936ad4fb2709af05a80cddf840b8570dc1abcfd5970d0f72f322c3c73d53b56ee31a02d5482ce50b70525f112df85838c1734952d0e0b8e310
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9Yq3q3hOPI2zjbggX3imxdamUTFYzl/Zod9BDZsx:EufspTf2g2GaCq323bHXSmxdamUpe/ic
TLSH
T101233B003BE9C12BF2BE4F78A9F22145867AF6732603D6491CC451DB5723BC69A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
lokibot.kacasatu.com:80
lokibot.kacasatu.com:22
lokibot.kacasatu.com:8080
lokibot.kacasatu.com:8880
lokibot.kacasatu.com:2052
lokibot.kacasatu.com:2082
lokibot.kacasatu.com:2086
lokibot.kacasatu.com:2095
lokibot.kacasatu.com:443
lokibot.kacasatu.com:2053
lokibot.kacasatu.com:2083
lokibot.kacasatu.com:2087
lokibot.kacasatu.com:2096
lokibot.kacasatu.com:8443
dridex.kacasatu.com:80
dridex.kacasatu.com:22
dridex.kacasatu.com:8080
dridex.kacasatu.com:8880
dridex.kacasatu.com:2052
dridex.kacasatu.com:2082
dridex.kacasatu.com:2086
dridex.kacasatu.com:2095
dridex.kacasatu.com:443
dridex.kacasatu.com:2053
dridex.kacasatu.com:2083
dridex.kacasatu.com:2087
dridex.kacasatu.com:2096
dridex.kacasatu.com:8443
hermeticwiper.kacasatu.com:80
hermeticwiper.kacasatu.com:22
hermeticwiper.kacasatu.com:8080
hermeticwiper.kacasatu.com:8880
hermeticwiper.kacasatu.com:2052
hermeticwiper.kacasatu.com:2082
hermeticwiper.kacasatu.com:2086
hermeticwiper.kacasatu.com:2095
hermeticwiper.kacasatu.com:443
hermeticwiper.kacasatu.com:2053
hermeticwiper.kacasatu.com:2083
hermeticwiper.kacasatu.com:2087
hermeticwiper.kacasatu.com:2096
hermeticwiper.kacasatu.com:8443

Mutex

cxoTX0q0lf8e

Attributes

delay
0
install
true
install_file
9zb5f5g.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4ff1914a23cf84dcf342ac28a2c32e6685c3b4081891f8c1469bd420308282e4
- Size 45KB
- SHA256 4ff1914a23cf84dcf342ac28a2c32e6685c3b4081891f8c1469bd420308282e4
- MD5 95121fe50e9532274bf7f5c0f17fb6e7
- SHA1 2458919b0edc26e9b2d1184a331cee822afe1b73
- SHA512 7e46bda777cf1f936ad4fb2709af05a80cddf840b8570dc1abcfd5970d0f72f322c3c73d53b56ee31a02d5482ce50b70525f112df85838c1734952d0e0b8e310
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9Yq3q3hOPI2zjbggX3imxdamUTFYzl/Zod9BDZsx:EufspTf2g2GaCq323bHXSmxdamUpe/ic
- TLSH
  T101233B003BE9C12BF2BE4F78A9F22145867AF6732603D6491CC451DB5723BC69A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2