asyncrat | 226f20e806f09a4e6b31156b871423b4e18b0191c0a55bc1edf32ec71f88ab10

Sharing

Copy URL Twitter E-mail

General

Target
226f20e806f09a4e6b31156b871423b4e18b0191c0a55bc1edf32ec71f88ab10
Size 45KB
Sample260722-hncassxva1
SHA256 226f20e806f09a4e6b31156b871423b4e18b0191c0a55bc1edf32ec71f88ab10
MD5 b39387f7aef9713eeffafda1ab20bd34
SHA1 08bb732bab527ff6903b38ec78cd08d53e07785b
SHA512 3defa4210ae14725afda16f7feb9e7ce91aa0cf779399e9dea32024163aa5a68357dd1aae2221981487ae7f27048bfebca9f26c090d9239570101d1f6f7f13d7
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HqJaxjwHuPIPzjbqgF3ikkbQ4lXioBDZUx:cu6YepTPso2S3+3P3b9FSkr4lyOdUx
TLSH
T107232C003BE9822BF1BE4FB898F26145867AF6637603D64D2CC451DB5723BC686426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
shamoon.kacasatu.com:80
shamoon.kacasatu.com:22
shamoon.kacasatu.com:8080
shamoon.kacasatu.com:8880
shamoon.kacasatu.com:2052
shamoon.kacasatu.com:2082
shamoon.kacasatu.com:2086
shamoon.kacasatu.com:2095
shamoon.kacasatu.com:443
shamoon.kacasatu.com:2053
shamoon.kacasatu.com:2083
shamoon.kacasatu.com:2087
shamoon.kacasatu.com:2096
shamoon.kacasatu.com:8443
malware.kacasatu.com:80
malware.kacasatu.com:22
malware.kacasatu.com:8080
malware.kacasatu.com:8880
malware.kacasatu.com:2052
malware.kacasatu.com:2082
malware.kacasatu.com:2086
malware.kacasatu.com:2095
malware.kacasatu.com:443
malware.kacasatu.com:2053
malware.kacasatu.com:2083
malware.kacasatu.com:2087
malware.kacasatu.com:2096
malware.kacasatu.com:8443
sobig.kacasatu.com:80
sobig.kacasatu.com:22
sobig.kacasatu.com:8080
sobig.kacasatu.com:8880
sobig.kacasatu.com:2052
sobig.kacasatu.com:2082
sobig.kacasatu.com:2086
sobig.kacasatu.com:2095
sobig.kacasatu.com:443
sobig.kacasatu.com:2053
sobig.kacasatu.com:2083
sobig.kacasatu.com:2087
sobig.kacasatu.com:2096
sobig.kacasatu.com:8443

Mutex

YHPnI6qLz2q6

Attributes

delay
0
install
true
install_file
6u0lfpfi.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  226f20e806f09a4e6b31156b871423b4e18b0191c0a55bc1edf32ec71f88ab10
- Size 45KB
- SHA256 226f20e806f09a4e6b31156b871423b4e18b0191c0a55bc1edf32ec71f88ab10
- MD5 b39387f7aef9713eeffafda1ab20bd34
- SHA1 08bb732bab527ff6903b38ec78cd08d53e07785b
- SHA512 3defa4210ae14725afda16f7feb9e7ce91aa0cf779399e9dea32024163aa5a68357dd1aae2221981487ae7f27048bfebca9f26c090d9239570101d1f6f7f13d7
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HqJaxjwHuPIPzjbqgF3ikkbQ4lXioBDZUx:cu6YepTPso2S3+3P3b9FSkr4lyOdUx
- TLSH
  T107232C003BE9822BF1BE4FB898F26145867AF6637603D64D2CC451DB5723BC686426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2