asyncrat | eaf0dd4b872b9b34832daa752acbea59d9d8f1389f0d4650c008396534c9a0fe

Sharing

Copy URL Twitter E-mail

General

Target
eaf0dd4b872b9b34832daa752acbea59d9d8f1389f0d4650c008396534c9a0fe
Size 45KB
Sample260721-vxt87aywat
SHA256 eaf0dd4b872b9b34832daa752acbea59d9d8f1389f0d4650c008396534c9a0fe
MD5 e2ded80b4d7214437c2dd74cf4ef3ec6
SHA1 b7698bd3507835970c2bf5e2fb4a521f6ecfde4f
SHA512 b7a655ad29452b576010a14782532c938c9c4b36cb96a00ee7745ee5018d70491d03c4eaa95ed263b8b400ce654c3f42716b9943427911d43d8bd6ca58624a2d
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFFeeXKSocbbbQtN8/nPI6kzjb6gX3i/tEa0xtWO7fb:cu7e5TH2A2deH2tNKA6k3btXS/tE5wOX
TLSH
T193231A0037E8812BF2BE4F78ADF261458A7AE6633603D54A1CC4519B5713FC68A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
malware.kacasatu.com:80
malware.kacasatu.com:22
malware.kacasatu.com:8080
malware.kacasatu.com:8880
malware.kacasatu.com:2052
malware.kacasatu.com:2082
malware.kacasatu.com:2086
malware.kacasatu.com:2095
malware.kacasatu.com:443
malware.kacasatu.com:2053
malware.kacasatu.com:2083
malware.kacasatu.com:2087
malware.kacasatu.com:2096
malware.kacasatu.com:8443
connect.kacasatu.com:80
connect.kacasatu.com:22
connect.kacasatu.com:8080
connect.kacasatu.com:8880
connect.kacasatu.com:2052
connect.kacasatu.com:2082
connect.kacasatu.com:2086
connect.kacasatu.com:2095
connect.kacasatu.com:443
connect.kacasatu.com:2053
connect.kacasatu.com:2083
connect.kacasatu.com:2087
connect.kacasatu.com:2096
connect.kacasatu.com:8443
mirai.kacasatu.com:80
mirai.kacasatu.com:22
mirai.kacasatu.com:8080
mirai.kacasatu.com:8880
mirai.kacasatu.com:2052
mirai.kacasatu.com:2082
mirai.kacasatu.com:2086
mirai.kacasatu.com:2095
mirai.kacasatu.com:443
mirai.kacasatu.com:2053
mirai.kacasatu.com:2083
mirai.kacasatu.com:2087
mirai.kacasatu.com:2096
mirai.kacasatu.com:8443

Mutex

AaDMatFOIMcx

Attributes

delay
0
install
true
install_file
vl1gx.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  eaf0dd4b872b9b34832daa752acbea59d9d8f1389f0d4650c008396534c9a0fe
- Size 45KB
- SHA256 eaf0dd4b872b9b34832daa752acbea59d9d8f1389f0d4650c008396534c9a0fe
- MD5 e2ded80b4d7214437c2dd74cf4ef3ec6
- SHA1 b7698bd3507835970c2bf5e2fb4a521f6ecfde4f
- SHA512 b7a655ad29452b576010a14782532c938c9c4b36cb96a00ee7745ee5018d70491d03c4eaa95ed263b8b400ce654c3f42716b9943427911d43d8bd6ca58624a2d
- SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFFeeXKSocbbbQtN8/nPI6kzjb6gX3i/tEa0xtWO7fb:cu7e5TH2A2deH2tNKA6k3btXS/tE5wOX
- TLSH
  T193231A0037E8812BF2BE4F78ADF261458A7AE6633603D54A1CC4519B5713FC68A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2