asyncrat | b50433a23c3b767326b39b652bb8239d661c24669d8303e6c21af8f7ad0fe2bc

Sharing

Copy URL Twitter E-mail

General

Target
b50433a23c3b767326b39b652bb8239d661c24669d8303e6c21af8f7ad0fe2bc
Size 45KB
Sample260721-ve5bfa1cjd
SHA256 b50433a23c3b767326b39b652bb8239d661c24669d8303e6c21af8f7ad0fe2bc
MD5 3e14cf01b83d14095b5eb14eecf9a189
SHA1 badbbeba3ceeb44612ce59a31542c35119de75ec
SHA512 607d7cbb23105fdc94da40f7dcf723b5510ae6cf781dfc4f9b265c735aa90b035fb45adb95aa1e0014b94d868bfff999d4773e65ef92b0b3672cfc858e34516e
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9IDEbHBqj2OPI/pzjb6gX3icf9RKzLMtObhhbwBDZ+:0u1YJTHcw2HyoK3/p3btXScV00Orbmd+
TLSH
T152232B003BE8823BF27E4F7899F26145867AF6633603D5491CC452D75623FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
qbot.kacasatu.com:80
qbot.kacasatu.com:22
qbot.kacasatu.com:8080
qbot.kacasatu.com:8880
qbot.kacasatu.com:2052
qbot.kacasatu.com:2082
qbot.kacasatu.com:2086
qbot.kacasatu.com:2095
qbot.kacasatu.com:443
qbot.kacasatu.com:2053
qbot.kacasatu.com:2083
qbot.kacasatu.com:2087
qbot.kacasatu.com:2096
qbot.kacasatu.com:8443
cryptolocker.kacasatu.com:80
cryptolocker.kacasatu.com:22
cryptolocker.kacasatu.com:8080
cryptolocker.kacasatu.com:8880
cryptolocker.kacasatu.com:2052
cryptolocker.kacasatu.com:2082
cryptolocker.kacasatu.com:2086
cryptolocker.kacasatu.com:2095
cryptolocker.kacasatu.com:443
cryptolocker.kacasatu.com:2053
cryptolocker.kacasatu.com:2083
cryptolocker.kacasatu.com:2087
cryptolocker.kacasatu.com:2096
cryptolocker.kacasatu.com:8443
nanocore.kacasatu.com:80
nanocore.kacasatu.com:22
nanocore.kacasatu.com:8080
nanocore.kacasatu.com:8880
nanocore.kacasatu.com:2052
nanocore.kacasatu.com:2082
nanocore.kacasatu.com:2086
nanocore.kacasatu.com:2095
nanocore.kacasatu.com:443
nanocore.kacasatu.com:2053
nanocore.kacasatu.com:2083
nanocore.kacasatu.com:2087
nanocore.kacasatu.com:2096
nanocore.kacasatu.com:8443

Mutex

YwybF3KhsGDZ

Attributes

delay
0
install
true
install_file
wcrcxu.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  b50433a23c3b767326b39b652bb8239d661c24669d8303e6c21af8f7ad0fe2bc
- Size 45KB
- SHA256 b50433a23c3b767326b39b652bb8239d661c24669d8303e6c21af8f7ad0fe2bc
- MD5 3e14cf01b83d14095b5eb14eecf9a189
- SHA1 badbbeba3ceeb44612ce59a31542c35119de75ec
- SHA512 607d7cbb23105fdc94da40f7dcf723b5510ae6cf781dfc4f9b265c735aa90b035fb45adb95aa1e0014b94d868bfff999d4773e65ef92b0b3672cfc858e34516e
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9IDEbHBqj2OPI/pzjb6gX3icf9RKzLMtObhhbwBDZ+:0u1YJTHcw2HyoK3/p3btXScV00Orbmd+
- TLSH
  T152232B003BE8823BF27E4F7899F26145867AF6633603D5491CC452D75623FC69A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2