asyncrat | 426a3abc184681e49bb809566eff5d2ec57d58dcea20656acf481a0a2401e91c

Sharing

Copy URL Twitter E-mail

General

Target
426a3abc184681e49bb809566eff5d2ec57d58dcea20656acf481a0a2401e91c
Size 45KB
Sample260722-smfxpsgd69
SHA256 426a3abc184681e49bb809566eff5d2ec57d58dcea20656acf481a0a2401e91c
MD5 7a51080c96b4fc81948cf91ca019dbcb
SHA1 ddea51384dca4891b97fedc171e4ea2d1e487bee
SHA512 c04b4a6b04b8d05ac74fbcb9d9f1aba1c854df25014092f5223c36d3f0986bad416a036f75631be05a97764c08136bed72feec1e2b580841df2f42b6881cef27
SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1r9PLziqyvtLjZPIvzjbXgXmifzZe9W+joPXhf+1wnF:cuR0JTPjY229HivVjWv3bwXPfPY+hf++
TLSH
T1AF233B0037E9812BF2BE4F78A9F26245867AF6636603D5891CC441DB5623FC6CA426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
sobig.kacasatu.com:80
sobig.kacasatu.com:22
sobig.kacasatu.com:8080
sobig.kacasatu.com:8880
sobig.kacasatu.com:2052
sobig.kacasatu.com:2082
sobig.kacasatu.com:2086
sobig.kacasatu.com:2095
sobig.kacasatu.com:443
sobig.kacasatu.com:2053
sobig.kacasatu.com:2083
sobig.kacasatu.com:2087
sobig.kacasatu.com:2096
sobig.kacasatu.com:8443
invasive.kacasatu.com:80
invasive.kacasatu.com:22
invasive.kacasatu.com:8080
invasive.kacasatu.com:8880
invasive.kacasatu.com:2052
invasive.kacasatu.com:2082
invasive.kacasatu.com:2086
invasive.kacasatu.com:2095
invasive.kacasatu.com:443
invasive.kacasatu.com:2053
invasive.kacasatu.com:2083
invasive.kacasatu.com:2087
invasive.kacasatu.com:2096
invasive.kacasatu.com:8443
revil.kacasatu.com:80
revil.kacasatu.com:22
revil.kacasatu.com:8080
revil.kacasatu.com:8880
revil.kacasatu.com:2052
revil.kacasatu.com:2082
revil.kacasatu.com:2086
revil.kacasatu.com:2095
revil.kacasatu.com:443
revil.kacasatu.com:2053
revil.kacasatu.com:2083
revil.kacasatu.com:2087
revil.kacasatu.com:2096
revil.kacasatu.com:8443

Mutex

IFBJgVOeMnbC

Attributes

delay
0
install
true
install_file
7usn.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  426a3abc184681e49bb809566eff5d2ec57d58dcea20656acf481a0a2401e91c
- Size 45KB
- SHA256 426a3abc184681e49bb809566eff5d2ec57d58dcea20656acf481a0a2401e91c
- MD5 7a51080c96b4fc81948cf91ca019dbcb
- SHA1 ddea51384dca4891b97fedc171e4ea2d1e487bee
- SHA512 c04b4a6b04b8d05ac74fbcb9d9f1aba1c854df25014092f5223c36d3f0986bad416a036f75631be05a97764c08136bed72feec1e2b580841df2f42b6881cef27
- SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1r9PLziqyvtLjZPIvzjbXgXmifzZe9W+joPXhf+1wnF:cuR0JTPjY229HivVjWv3bwXPfPY+hf++
- TLSH
  T1AF233B0037E9812BF2BE4F78A9F26245867AF6636603D5891CC441DB5623FC6CA426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2