| Hash / Información | Valor |
|---|---|
| SHA256 | 8c66c93d00fd52ad2efc773b29e339f3164bca178ea201009ba7d65a21f62e51 |
| MD5 | 8b4d740adbe4635b5ee756b7a6bf996d |
| SHA1 | 6404251e3555978f081f9bd17e9b295f59166680 |
| ImpHash | f34d5f2d4577ed6d9ceec516c1f5a744 |
| Archivo Adi | mko1.exe |
| Tipo de archivo | exe |
| Tamaño | 48,640 bytes |
| Primera detección | 2026-05-14 |
Tehdit Valorlendirmesi
Bu ornek, saldırganlara ele gecirilen sistemler uzerinde tam uzaktan kontrol imkani sunan bir RAT (Uzaktan Erisim Trojanı) olarak tespit edilmistir. Keylogging, ekran goruntüsü alma, dosya yonetimi ve kabuk erisimi gibi kapsamlı gozetleme yeteneklerine sahiptir.
Capacidades detectadas
- Uzaktan Erisim
- Keylogging
- Ekran Goruntüsü
- Archivo Yonetimi
- Kabuk Erisimi
Etiquetas de MalwareBazaar
Nota de análisis
Bu ornek AsyncRAT ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
AsyncRAT — Perfil del malware
AsyncRAT, 2019'da acik kaynak olarak yayimlanan C# tabanli RAT ailesidir. Ekran yakalama, keylogger, dosya islemleri, HVNC ve plugin sistemine sahiptir. C2 AES-128-CBC ile sifrelenir, TCP uzerinden calisir. JS/PDF yemi ile dagitilir.
Detalles técnicos
C# .NET, AES-128-CBC sifreleme, TCP port 6606/4449 (varsayilan), Mutex kontrol, Runtime assembly loading, Anti-analysis (VM check, Process listesi), HVNC, Keylogger, Stealer, Botnet modulu
Atribución / Actor de amenaza
Acik kaynak - orjinal gelistirici GitHub'da yayinladi; surekli siber suclu toplulugu tarafindan kullanilmaktadir. APT operasyonlari da dahil olmak uzere cok sayida farkli tehdit aktoru kullanmaktadir.
Capacidades y comportamiento
Lista IOC (24 indicadores)
# SHA256
8c66c93d00fd52ad2efc773b29e339f3164bca178ea201009ba7d65a21f62e51
# MD5
8b4d740adbe4635b5ee756b7a6bf996d
# IP
185.220.101.12
# IP
45.86.86.159
# IP
193.142.146.68
# IP
149.102.143.58
# IP
89.187.167.118
# IP
185.238.228.50
# IP
5.39.63.112
# IP
193.142.146.35
# IP
37.48.89.107
# DOMAIN
async-control.ddns.net
# DOMAIN
remote-admin-panel.ru
# DOMAIN
my-home-server.zapto.org
# MUTEX
AsyncMutex_6SI8OkPnk
# MUTEX
GlobalAsyncTask2025
# MUTEX
AsyncMutex_4ef16dce
# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsNT
# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRunUpdate
# FILEPATH
%APPDATA%RoamingAsyncRATAsyncRAT.exe
# FILEPATH
%TEMP%SYN.exe
# FILEPATH
%TEMP%AsyncTask.exe
# FILEPATH
%APPDATA%AsyncRATclient.exe
# URL
https://async-rat-cdn.top/payload.exe
| Tipo | Valor | Nota |
|---|---|---|
| sha256 | 8c66c93d00fd52ad2efc773b29e339f3164bca178ea201009ba7d65a21f62e51 | |
| md5 | 8b4d740adbe4635b5ee756b7a6bf996d | |
| ip | 185.220.101.12 | C2:6606 |
| ip | 45.86.86.159 | C2:4444 |
| ip | 193.142.146.68 | C2:7707 |
| ip | 149.102.143.58 | C2:6606 |
| ip | 89.187.167.118 | C2:4449 |
| ip | 185.238.228.50 | AsyncRAT C2 Avrupa |
| ip | 5.39.63.112 | AsyncRAT C2 Fransa |
| ip | 193.142.146.35 | C2:6606 |
| ip | 37.48.89.107 | C2:4782 |
| domain | async-control.ddns.net | AsyncRAT DDNS C2 domain |
| domain | remote-admin-panel.ru | AsyncRAT panel domain - Russia hosting |
| domain | my-home-server.zapto.org | AsyncRAT dynamic DNS C2 |
| mutex | AsyncMutex_6SI8OkPnk | AsyncRAT default mutex - builder degistirilmemis |
| mutex | GlobalAsyncTask2025 | AsyncRAT 2025 varyant - custom mutex |
| mutex | AsyncMutex_4ef16dce | AsyncRAT default mutex |
| registry | HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsNT | AsyncRAT persistence - system process adina |
| registry | HKCUSoftwareMicrosoftWindowsCurrentVersionRunUpdate | AsyncRAT Run key |
| filepath | %APPDATA%RoamingAsyncRATAsyncRAT.exe | AsyncRAT dropped binary path |
| filepath | %TEMP%SYN.exe | AsyncRAT temp dropper |
| filepath | %TEMP%AsyncTask.exe | AsyncRAT dropped loader |
| filepath | %APPDATA%AsyncRATclient.exe | AsyncRAT istemci yolu |
| url | https://async-rat-cdn.top/payload.exe | AsyncRAT payload delivery URL |
Servidores C2 (8 servidores registrados para esta familia)
| Dirección | Tipo | Puerto | Protocolo | Estado | País |
|---|---|---|---|---|---|
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
Las direcciones C2 se proporcionan únicamente a partir de muestras de malware verificadas manualmente por el equipo KEYDAL. Se prohíbe el uso comercial.