asyncrat | 1b12e0ad78663f58295cb0d175887571deaedb2428c329c911e202f6889d9608

Sharing

Copy URL Twitter E-mail

General

Target
1b12e0ad78663f58295cb0d175887571deaedb2428c329c911e202f6889d9608
Size 45KB
Sample260722-dkhwysvsgv
SHA256 1b12e0ad78663f58295cb0d175887571deaedb2428c329c911e202f6889d9608
MD5 840356a9b6efc0a39060ed9fa7b3b50b
SHA1 6dc1658546ef88fa33e89524892a34cca24a5e35
SHA512 86ae2671d86321bc2b8afea367cf37d8814b92ce7ed05494b1299acb8fcec6a98a2feb460b8b95a051a7b9a645adf827cc44f09b0aefb1c16dcdf8f2a02eaac5
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAEuwZQaKkPIuzjbIgX3ivd1MzGNwCyJ9XBVBDZcx:UuKWgSJTwRf2oIu3bfXSvs6uxXNdcx
TLSH
T191232C003BE8813BF2BE4FB86CF26145467AF5632603D94D6CC4519B5A23FC58A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
hacker.kacasatu.com:80
hacker.kacasatu.com:22
hacker.kacasatu.com:8080
hacker.kacasatu.com:8880
hacker.kacasatu.com:2052
hacker.kacasatu.com:2082
hacker.kacasatu.com:2086
hacker.kacasatu.com:2095
hacker.kacasatu.com:443
hacker.kacasatu.com:2053
hacker.kacasatu.com:2083
hacker.kacasatu.com:2087
hacker.kacasatu.com:2096
hacker.kacasatu.com:8443
gh0st.kacasatu.com:80
gh0st.kacasatu.com:22
gh0st.kacasatu.com:8080
gh0st.kacasatu.com:8880
gh0st.kacasatu.com:2052
gh0st.kacasatu.com:2082
gh0st.kacasatu.com:2086
gh0st.kacasatu.com:2095
gh0st.kacasatu.com:443
gh0st.kacasatu.com:2053
gh0st.kacasatu.com:2083
gh0st.kacasatu.com:2087
gh0st.kacasatu.com:2096
gh0st.kacasatu.com:8443
trickbot.kacasatu.com:80
trickbot.kacasatu.com:22
trickbot.kacasatu.com:8080
trickbot.kacasatu.com:8880
trickbot.kacasatu.com:2052
trickbot.kacasatu.com:2082
trickbot.kacasatu.com:2086
trickbot.kacasatu.com:2095
trickbot.kacasatu.com:443
trickbot.kacasatu.com:2053
trickbot.kacasatu.com:2083
trickbot.kacasatu.com:2087
trickbot.kacasatu.com:2096
trickbot.kacasatu.com:8443
cryptolocker.kacasatu.com:80
cryptolocker.kacasatu.com:22
cryptolocker.kacasatu.com:8080
cryptolocker.kacasatu.com:8880
cryptolocker.kacasatu.com:2052
cryptolocker.kacasatu.com:2082
cryptolocker.kacasatu.com:2086
cryptolocker.kacasatu.com:2095
cryptolocker.kacasatu.com:443
cryptolocker.kacasatu.com:2053
cryptolocker.kacasatu.com:2083
cryptolocker.kacasatu.com:2087
cryptolocker.kacasatu.com:2096
cryptolocker.kacasatu.com:8443

Mutex

fAuOghoirEpv

Attributes

delay
0
install
true
install_file
83ir0h91.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1b12e0ad78663f58295cb0d175887571deaedb2428c329c911e202f6889d9608
- Size 45KB
- SHA256 1b12e0ad78663f58295cb0d175887571deaedb2428c329c911e202f6889d9608
- MD5 840356a9b6efc0a39060ed9fa7b3b50b
- SHA1 6dc1658546ef88fa33e89524892a34cca24a5e35
- SHA512 86ae2671d86321bc2b8afea367cf37d8814b92ce7ed05494b1299acb8fcec6a98a2feb460b8b95a051a7b9a645adf827cc44f09b0aefb1c16dcdf8f2a02eaac5
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAEuwZQaKkPIuzjbIgX3ivd1MzGNwCyJ9XBVBDZcx:UuKWgSJTwRf2oIu3bfXSvs6uxXNdcx
- TLSH
  T191232C003BE8813BF2BE4FB86CF26145467AF5632603D94D6CC4519B5A23FC58A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2