| Hash / Informação | Valor |
|---|---|
| SHA256 | 8c66c93d00fd52ad2efc773b29e339f3164bca178ea201009ba7d65a21f62e51 |
| MD5 | 8b4d740adbe4635b5ee756b7a6bf996d |
| SHA1 | 6404251e3555978f081f9bd17e9b295f59166680 |
| ImpHash | f34d5f2d4577ed6d9ceec516c1f5a744 |
| Arquivo Adi | mko1.exe |
| Tipo de arquivo | exe |
| Tamanho | 48,640 bytes |
| Primeira detecção | 2026-05-14 |
Tehdit Valorlendirmesi
Bu ornek, saldırganlara ele gecirilen sistemler uzerinde tam uzaktan kontrol imkani sunan bir RAT (Uzaktan Erisim Trojanı) olarak tespit edilmistir. Keylogging, ekran goruntüsü alma, dosya yonetimi ve kabuk erisimi gibi kapsamlı gozetleme yeteneklerine sahiptir.
Capacidades detectadas
- Uzaktan Erisim
- Keylogging
- Ekran Goruntüsü
- Arquivo Yonetimi
- Kabuk Erisimi
Tags do MalwareBazaar
Nota de análise
Bu ornek AsyncRAT ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
AsyncRAT — Perfil do malware
AsyncRAT, 2019'da acik kaynak olarak yayimlanan C# tabanli RAT ailesidir. Ekran yakalama, keylogger, dosya islemleri, HVNC ve plugin sistemine sahiptir. C2 AES-128-CBC ile sifrelenir, TCP uzerinden calisir. JS/PDF yemi ile dagitilir.
Detalhes técnicos
C# .NET, AES-128-CBC sifreleme, TCP port 6606/4449 (varsayilan), Mutex kontrol, Runtime assembly loading, Anti-analysis (VM check, Process listesi), HVNC, Keylogger, Stealer, Botnet modulu
Atribuição / Ator da ameaça
Acik kaynak - orjinal gelistirici GitHub'da yayinladi; surekli siber suclu toplulugu tarafindan kullanilmaktadir. APT operasyonlari da dahil olmak uzere cok sayida farkli tehdit aktoru kullanmaktadir.
Capacidades e comportamento
Lista IOC (24 indicadores)
# SHA256
8c66c93d00fd52ad2efc773b29e339f3164bca178ea201009ba7d65a21f62e51
# MD5
8b4d740adbe4635b5ee756b7a6bf996d
# IP
185.220.101.12
# IP
45.86.86.159
# IP
193.142.146.68
# IP
149.102.143.58
# IP
89.187.167.118
# IP
185.238.228.50
# IP
5.39.63.112
# IP
193.142.146.35
# IP
37.48.89.107
# DOMAIN
async-control.ddns.net
# DOMAIN
remote-admin-panel.ru
# DOMAIN
my-home-server.zapto.org
# MUTEX
AsyncMutex_6SI8OkPnk
# MUTEX
GlobalAsyncTask2025
# MUTEX
AsyncMutex_4ef16dce
# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsNT
# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRunUpdate
# FILEPATH
%APPDATA%RoamingAsyncRATAsyncRAT.exe
# FILEPATH
%TEMP%SYN.exe
# FILEPATH
%TEMP%AsyncTask.exe
# FILEPATH
%APPDATA%AsyncRATclient.exe
# URL
https://async-rat-cdn.top/payload.exe
| Tipo | Valor | Nota |
|---|---|---|
| sha256 | 8c66c93d00fd52ad2efc773b29e339f3164bca178ea201009ba7d65a21f62e51 | |
| md5 | 8b4d740adbe4635b5ee756b7a6bf996d | |
| ip | 185.220.101.12 | C2:6606 |
| ip | 45.86.86.159 | C2:4444 |
| ip | 193.142.146.68 | C2:7707 |
| ip | 149.102.143.58 | C2:6606 |
| ip | 89.187.167.118 | C2:4449 |
| ip | 185.238.228.50 | AsyncRAT C2 Avrupa |
| ip | 5.39.63.112 | AsyncRAT C2 Fransa |
| ip | 193.142.146.35 | C2:6606 |
| ip | 37.48.89.107 | C2:4782 |
| domain | async-control.ddns.net | AsyncRAT DDNS C2 domain |
| domain | remote-admin-panel.ru | AsyncRAT panel domain - Russia hosting |
| domain | my-home-server.zapto.org | AsyncRAT dynamic DNS C2 |
| mutex | AsyncMutex_6SI8OkPnk | AsyncRAT default mutex - builder degistirilmemis |
| mutex | GlobalAsyncTask2025 | AsyncRAT 2025 varyant - custom mutex |
| mutex | AsyncMutex_4ef16dce | AsyncRAT default mutex |
| registry | HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsNT | AsyncRAT persistence - system process adina |
| registry | HKCUSoftwareMicrosoftWindowsCurrentVersionRunUpdate | AsyncRAT Run key |
| filepath | %APPDATA%RoamingAsyncRATAsyncRAT.exe | AsyncRAT dropped binary path |
| filepath | %TEMP%SYN.exe | AsyncRAT temp dropper |
| filepath | %TEMP%AsyncTask.exe | AsyncRAT dropped loader |
| filepath | %APPDATA%AsyncRATclient.exe | AsyncRAT istemci yolu |
| url | https://async-rat-cdn.top/payload.exe | AsyncRAT payload delivery URL |
Servidores C2 (8 servidores registrados para esta família)
| Endereço | Tipo | Porta | Protocolo | Status | País |
|---|---|---|---|---|---|
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
Os endereços C2 são fornecidos apenas a partir de amostras de malware verificadas manualmente pela equipe KEYDAL. O uso comercial é proibido.