asyncrat | c6776a39785a0b42e59b625091bd10cc30c46f85397d16d6f835347e383e1da7

Sharing

Copy URL Twitter E-mail

General

Target
c6776a39785a0b42e59b625091bd10cc30c46f85397d16d6f835347e383e1da7
Size 45KB
Sample260721-tdbr3acb22
SHA256 c6776a39785a0b42e59b625091bd10cc30c46f85397d16d6f835347e383e1da7
MD5 d9b68d4b21a1081273d77f9611c206c3
SHA1 581629cd421d44aa77be32bfe7cf185164824219
SHA512 a9d89a3305b81bda251094bf0f937195651760ffbd2eed6c960ea33f60fbf7394ad2d78bad6aa7bb345338ebbc60bdb5a799922f7aa40f29af87f93f6fdba58b
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEa+PIvGjbjgX3i9L8Usc2A6IQ2O4BDZMx:ku40ZTXEb2C4EaHvqb8XStN2A6IQ2O+8
TLSH
T1A1232A003BE9C22BF2BE5F789DF26105867AF6632603D5492CC411DB5713FC69A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
dridex.kacasatu.com:80
dridex.kacasatu.com:22
dridex.kacasatu.com:8080
dridex.kacasatu.com:8880
dridex.kacasatu.com:2052
dridex.kacasatu.com:2082
dridex.kacasatu.com:2086
dridex.kacasatu.com:2095
dridex.kacasatu.com:443
dridex.kacasatu.com:2053
dridex.kacasatu.com:2083
dridex.kacasatu.com:2087
dridex.kacasatu.com:2096
dridex.kacasatu.com:8443
shamoon.kacasatu.com:80
shamoon.kacasatu.com:22
shamoon.kacasatu.com:8080
shamoon.kacasatu.com:8880
shamoon.kacasatu.com:2052
shamoon.kacasatu.com:2082
shamoon.kacasatu.com:2086
shamoon.kacasatu.com:2095
shamoon.kacasatu.com:443
shamoon.kacasatu.com:2053
shamoon.kacasatu.com:2083
shamoon.kacasatu.com:2087
shamoon.kacasatu.com:2096
shamoon.kacasatu.com:8443
blacklotus.kacasatu.com:80
blacklotus.kacasatu.com:22
blacklotus.kacasatu.com:8080
blacklotus.kacasatu.com:8880
blacklotus.kacasatu.com:2052
blacklotus.kacasatu.com:2082
blacklotus.kacasatu.com:2086
blacklotus.kacasatu.com:2095
blacklotus.kacasatu.com:443
blacklotus.kacasatu.com:2053
blacklotus.kacasatu.com:2083
blacklotus.kacasatu.com:2087
blacklotus.kacasatu.com:2096
blacklotus.kacasatu.com:8443
nimda.kacasatu.com:80
nimda.kacasatu.com:22
nimda.kacasatu.com:8080
nimda.kacasatu.com:8880
nimda.kacasatu.com:2052
nimda.kacasatu.com:2082
nimda.kacasatu.com:2086
nimda.kacasatu.com:2095
nimda.kacasatu.com:443
nimda.kacasatu.com:2053
nimda.kacasatu.com:2083
nimda.kacasatu.com:2087
nimda.kacasatu.com:2096
nimda.kacasatu.com:8443

Mutex

qb2MXCt1CigY

Attributes

delay
0
install
true
install_file
uwci7.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  c6776a39785a0b42e59b625091bd10cc30c46f85397d16d6f835347e383e1da7
- Size 45KB
- SHA256 c6776a39785a0b42e59b625091bd10cc30c46f85397d16d6f835347e383e1da7
- MD5 d9b68d4b21a1081273d77f9611c206c3
- SHA1 581629cd421d44aa77be32bfe7cf185164824219
- SHA512 a9d89a3305b81bda251094bf0f937195651760ffbd2eed6c960ea33f60fbf7394ad2d78bad6aa7bb345338ebbc60bdb5a799922f7aa40f29af87f93f6fdba58b
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEa+PIvGjbjgX3i9L8Usc2A6IQ2O4BDZMx:ku40ZTXEb2C4EaHvqb8XStN2A6IQ2O+8
- TLSH
  T1A1232A003BE9C22BF2BE5F789DF26105867AF6632603D5492CC411DB5713FC69A426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2