asyncrat | 48a02b86e507a4a1c1e0fb4c55b982dcf18cae2cdc1c4bee9d4c09a11530ba3b

Sharing

Copy URL Twitter E-mail

General

Target
48a02b86e507a4a1c1e0fb4c55b982dcf18cae2cdc1c4bee9d4c09a11530ba3b
Size 45KB
Sample260722-vvkxqszdnc
SHA256 48a02b86e507a4a1c1e0fb4c55b982dcf18cae2cdc1c4bee9d4c09a11530ba3b
MD5 3f7c59fdb021d6b9ed709f32103635f5
SHA1 2e3794cdc7462c0061f2f101acfded2af0f9ddfc
SHA512 534c284b57821bb52a1cadf55c2620ab9838c41ef258fdf4b7e9a3e61967a883fc85c66e2d30e54956615e3bd9a7ddc2c5961e259bebddbf9807cb71598cabee
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9q9YqPq3hOPIezjbMgX3iG6oYdoaOXxu+0H1RBDZ8x:0uPrpT/qY2Haqq3e3bDXSjoYBsQVvd8x
TLSH
T1FC232B003BE8C12BF2BE9F789DF26105867AF2632603D64A1CC451D75713BC69A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

kacasatu.com:80
kacasatu.com:22
kacasatu.com:8080
kacasatu.com:8880
kacasatu.com:2052
kacasatu.com:2082
kacasatu.com:2086
kacasatu.com:2095
kacasatu.com:443
kacasatu.com:2053
kacasatu.com:2083
kacasatu.com:2087
kacasatu.com:2096
kacasatu.com:8443
www.kacasatu.com:80
www.kacasatu.com:22
www.kacasatu.com:8080
www.kacasatu.com:8880
www.kacasatu.com:2052
www.kacasatu.com:2082
www.kacasatu.com:2086
www.kacasatu.com:2095
www.kacasatu.com:443
www.kacasatu.com:2053
www.kacasatu.com:2083
www.kacasatu.com:2087
www.kacasatu.com:2096
www.kacasatu.com:8443
zeus.kacasatu.com:80
zeus.kacasatu.com:22
zeus.kacasatu.com:8080
zeus.kacasatu.com:8880
zeus.kacasatu.com:2052
zeus.kacasatu.com:2082
zeus.kacasatu.com:2086
zeus.kacasatu.com:2095
zeus.kacasatu.com:443
zeus.kacasatu.com:2053
zeus.kacasatu.com:2083
zeus.kacasatu.com:2087
zeus.kacasatu.com:2096
zeus.kacasatu.com:8443
azorult.kacasatu.com:80
azorult.kacasatu.com:22
azorult.kacasatu.com:8080
azorult.kacasatu.com:8880
azorult.kacasatu.com:2052
azorult.kacasatu.com:2082
azorult.kacasatu.com:2086
azorult.kacasatu.com:2095
azorult.kacasatu.com:443
azorult.kacasatu.com:2053
azorult.kacasatu.com:2083
azorult.kacasatu.com:2087
azorult.kacasatu.com:2096
azorult.kacasatu.com:8443
invasive.kacasatu.com:80
invasive.kacasatu.com:22
invasive.kacasatu.com:8080
invasive.kacasatu.com:8880
invasive.kacasatu.com:2052
invasive.kacasatu.com:2082
invasive.kacasatu.com:2086
invasive.kacasatu.com:2095
invasive.kacasatu.com:443
invasive.kacasatu.com:2053
invasive.kacasatu.com:2083
invasive.kacasatu.com:2087
invasive.kacasatu.com:2096
invasive.kacasatu.com:8443

Mutex

mCRr3zq2gNce

Attributes

delay
0
install
true
install_file
fucfa5f.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  48a02b86e507a4a1c1e0fb4c55b982dcf18cae2cdc1c4bee9d4c09a11530ba3b
- Size 45KB
- SHA256 48a02b86e507a4a1c1e0fb4c55b982dcf18cae2cdc1c4bee9d4c09a11530ba3b
- MD5 3f7c59fdb021d6b9ed709f32103635f5
- SHA1 2e3794cdc7462c0061f2f101acfded2af0f9ddfc
- SHA512 534c284b57821bb52a1cadf55c2620ab9838c41ef258fdf4b7e9a3e61967a883fc85c66e2d30e54956615e3bd9a7ddc2c5961e259bebddbf9807cb71598cabee
- SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9q9YqPq3hOPIezjbMgX3iG6oYdoaOXxu+0H1RBDZ8x:0uPrpT/qY2Haqq3e3bDXSjoYBsQVvd8x
- TLSH
  T1FC232B003BE8C12BF2BE9F789DF26105867AF2632603D64A1CC451D75713BC69A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2