asyncrat | bd5f67e956a0fb8342f3e1125deded03bf5e419d448cc8c6d369159b41f02280

Sharing

Copy URL Twitter E-mail

General

Target
bd5f67e956a0fb8342f3e1125deded03bf5e419d448cc8c6d369159b41f02280
Size 45KB
Sample260722-tyj9yavyat
SHA256 bd5f67e956a0fb8342f3e1125deded03bf5e419d448cc8c6d369159b41f02280
MD5 38f42650d0cb91922ad025278149ffab
SHA1 908afdea9c5fa1512f0909bec87bbd36899dd256
SHA512 acbbd39c2ff8e4961f861bc6bff3783b78765b0dedbb075f81c45b9e48e44252cb8ea433b0bcf64b55bc0d0bef007030eace3427b2c6c8516ac334c0f26a651c
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwnZTohEaSPIkzjbLgX3iAtfpf9cKqYZdBDZMx:ku40ZTXEb2d4Ea7k3b0XSQfpfinidMx
TLSH
T11C232B003BE8822BF2BE5F789DF26145867AF6732603D54A1CC441D75713FC69A42AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
connect.kacasatu.com:80
connect.kacasatu.com:22
connect.kacasatu.com:8080
connect.kacasatu.com:8880
connect.kacasatu.com:2052
connect.kacasatu.com:2082
connect.kacasatu.com:2086
connect.kacasatu.com:2095
connect.kacasatu.com:443
connect.kacasatu.com:2053
connect.kacasatu.com:2083
connect.kacasatu.com:2087
connect.kacasatu.com:2096
connect.kacasatu.com:8443
client.kacasatu.com:80
client.kacasatu.com:22
client.kacasatu.com:8080
client.kacasatu.com:8880
client.kacasatu.com:2052
client.kacasatu.com:2082
client.kacasatu.com:2086
client.kacasatu.com:2095
client.kacasatu.com:443
client.kacasatu.com:2053
client.kacasatu.com:2083
client.kacasatu.com:2087
client.kacasatu.com:2096
client.kacasatu.com:8443
conficker.kacasatu.com:80
conficker.kacasatu.com:22
conficker.kacasatu.com:8080
conficker.kacasatu.com:8880
conficker.kacasatu.com:2052
conficker.kacasatu.com:2082
conficker.kacasatu.com:2086
conficker.kacasatu.com:2095
conficker.kacasatu.com:443
conficker.kacasatu.com:2053
conficker.kacasatu.com:2083
conficker.kacasatu.com:2087
conficker.kacasatu.com:2096
conficker.kacasatu.com:8443
codered.kacasatu.com:80
codered.kacasatu.com:22
codered.kacasatu.com:8080
codered.kacasatu.com:8880
codered.kacasatu.com:2052
codered.kacasatu.com:2082
codered.kacasatu.com:2086
codered.kacasatu.com:2095
codered.kacasatu.com:443
codered.kacasatu.com:2053
codered.kacasatu.com:2083
codered.kacasatu.com:2087
codered.kacasatu.com:2096
codered.kacasatu.com:8443

Mutex

rCNikjBqzaGb

Attributes

delay
0
install
true
install_file
cc3a5.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  bd5f67e956a0fb8342f3e1125deded03bf5e419d448cc8c6d369159b41f02280
- Size 45KB
- SHA256 bd5f67e956a0fb8342f3e1125deded03bf5e419d448cc8c6d369159b41f02280
- MD5 38f42650d0cb91922ad025278149ffab
- SHA1 908afdea9c5fa1512f0909bec87bbd36899dd256
- SHA512 acbbd39c2ff8e4961f861bc6bff3783b78765b0dedbb075f81c45b9e48e44252cb8ea433b0bcf64b55bc0d0bef007030eace3427b2c6c8516ac334c0f26a651c
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwnZTohEaSPIkzjbLgX3iAtfpf9cKqYZdBDZMx:ku40ZTXEb2d4Ea7k3b0XSQfpfinidMx
- TLSH
  T11C232B003BE8822BF2BE5F789DF26145867AF6732603D54A1CC441D75713FC69A42AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2