asyncrat | ac22b085257de8c0058c9382d5e554f4dd6b2d204cb011181775adf22914e481

Sharing

Copy URL Twitter E-mail

General

Target
ac22b085257de8c0058c9382d5e554f4dd6b2d204cb011181775adf22914e481
Size 45KB
Sample260722-g9lwpawzhy
SHA256 ac22b085257de8c0058c9382d5e554f4dd6b2d204cb011181775adf22914e481
MD5 f9b214aa37185d4d5d268e7992e0e98d
SHA1 5ae62c87ef06a1ac8ecfa4a344e63b676a8c90ad
SHA512 53eb6855bcbf7540161fed7117e5a0471a2839a5fee73138270a76028d1e30bf4bb2662bf48c79635ec0c6d8dc52878f23cf326f72c3d4aba3bf5738c7a24e11
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9OoopCBK9INJPIZzjbOgX3iiHLwYVvdxBDZsx:EufspTf2g2bo6bIwZ3bxXSeHvdPdsx
TLSH
T18C231A0037E8C12BF2BE4F78A9F26145467AF2736603E54D2CC451DB5623BC69642AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
emotet.kacasatu.com:80
emotet.kacasatu.com:22
emotet.kacasatu.com:8080
emotet.kacasatu.com:8880
emotet.kacasatu.com:2052
emotet.kacasatu.com:2082
emotet.kacasatu.com:2086
emotet.kacasatu.com:2095
emotet.kacasatu.com:443
emotet.kacasatu.com:2053
emotet.kacasatu.com:2083
emotet.kacasatu.com:2087
emotet.kacasatu.com:2096
emotet.kacasatu.com:8443
remcos.kacasatu.com:80
remcos.kacasatu.com:22
remcos.kacasatu.com:8080
remcos.kacasatu.com:8880
remcos.kacasatu.com:2052
remcos.kacasatu.com:2082
remcos.kacasatu.com:2086
remcos.kacasatu.com:2095
remcos.kacasatu.com:443
remcos.kacasatu.com:2053
remcos.kacasatu.com:2083
remcos.kacasatu.com:2087
remcos.kacasatu.com:2096
remcos.kacasatu.com:8443
wannacry.kacasatu.com:80
wannacry.kacasatu.com:22
wannacry.kacasatu.com:8080
wannacry.kacasatu.com:8880
wannacry.kacasatu.com:2052
wannacry.kacasatu.com:2082
wannacry.kacasatu.com:2086
wannacry.kacasatu.com:2095
wannacry.kacasatu.com:443
wannacry.kacasatu.com:2053
wannacry.kacasatu.com:2083
wannacry.kacasatu.com:2087
wannacry.kacasatu.com:2096
wannacry.kacasatu.com:8443
mirai.kacasatu.com:80
mirai.kacasatu.com:22
mirai.kacasatu.com:8080
mirai.kacasatu.com:8880
mirai.kacasatu.com:2052
mirai.kacasatu.com:2082
mirai.kacasatu.com:2086
mirai.kacasatu.com:2095
mirai.kacasatu.com:443
mirai.kacasatu.com:2053
mirai.kacasatu.com:2083
mirai.kacasatu.com:2087
mirai.kacasatu.com:2096
mirai.kacasatu.com:8443

Mutex

EUQOvjtbC5z7

Attributes

delay
0
install
true
install_file
sza6aav.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  ac22b085257de8c0058c9382d5e554f4dd6b2d204cb011181775adf22914e481
- Size 45KB
- SHA256 ac22b085257de8c0058c9382d5e554f4dd6b2d204cb011181775adf22914e481
- MD5 f9b214aa37185d4d5d268e7992e0e98d
- SHA1 5ae62c87ef06a1ac8ecfa4a344e63b676a8c90ad
- SHA512 53eb6855bcbf7540161fed7117e5a0471a2839a5fee73138270a76028d1e30bf4bb2662bf48c79635ec0c6d8dc52878f23cf326f72c3d4aba3bf5738c7a24e11
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9OoopCBK9INJPIZzjbOgX3iiHLwYVvdxBDZsx:EufspTf2g2bo6bIwZ3bxXSeHvdPdsx
- TLSH
  T18C231A0037E8C12BF2BE4F78A9F26145467AF2736603E54D2CC451DB5623BC69642AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2