| Хеш / Информация | Значение |
|---|---|
| SHA256 | 8c66c93d00fd52ad2efc773b29e339f3164bca178ea201009ba7d65a21f62e51 |
| MD5 | 8b4d740adbe4635b5ee756b7a6bf996d |
| SHA1 | 6404251e3555978f081f9bd17e9b295f59166680 |
| ImpHash | f34d5f2d4577ed6d9ceec516c1f5a744 |
| Файл Adi | mko1.exe |
| Тип файла | exe |
| Размер | 48,640 bytes |
| Первое обнаружение | 2026-05-14 |
Tehdit Значениеlendirmesi
Bu ornek, saldırganlara ele gecirilen sistemler uzerinde tam uzaktan kontrol imkani sunan bir RAT (Uzaktan Erisim Trojanı) olarak tespit edilmistir. Keylogging, ekran goruntüsü alma, dosya yonetimi ve kabuk erisimi gibi kapsamlı gozetleme yeteneklerine sahiptir.
Обнаруженные возможности
- Uzaktan Erisim
- Keylogging
- Ekran Goruntüsü
- Файл Yonetimi
- Kabuk Erisimi
Метки MalwareBazaar
Примечание к анализу
Bu ornek AsyncRAT ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
AsyncRAT — Профиль вредоносного ПО
AsyncRAT, 2019'da acik kaynak olarak yayimlanan C# tabanli RAT ailesidir. Ekran yakalama, keylogger, dosya islemleri, HVNC ve plugin sistemine sahiptir. C2 AES-128-CBC ile sifrelenir, TCP uzerinden calisir. JS/PDF yemi ile dagitilir.
Технические детали
C# .NET, AES-128-CBC sifreleme, TCP port 6606/4449 (varsayilan), Mutex kontrol, Runtime assembly loading, Anti-analysis (VM check, Process listesi), HVNC, Keylogger, Stealer, Botnet modulu
Атрибуция / Актор угрозы
Acik kaynak - orjinal gelistirici GitHub'da yayinladi; surekli siber suclu toplulugu tarafindan kullanilmaktadir. APT operasyonlari da dahil olmak uzere cok sayida farkli tehdit aktoru kullanmaktadir.
Возможности и поведение
Список IOC (24 индикаторов)
# SHA256
8c66c93d00fd52ad2efc773b29e339f3164bca178ea201009ba7d65a21f62e51
# MD5
8b4d740adbe4635b5ee756b7a6bf996d
# IP
185.220.101.12
# IP
45.86.86.159
# IP
193.142.146.68
# IP
149.102.143.58
# IP
89.187.167.118
# IP
185.238.228.50
# IP
5.39.63.112
# IP
193.142.146.35
# IP
37.48.89.107
# DOMAIN
async-control.ddns.net
# DOMAIN
remote-admin-panel.ru
# DOMAIN
my-home-server.zapto.org
# MUTEX
AsyncMutex_6SI8OkPnk
# MUTEX
GlobalAsyncTask2025
# MUTEX
AsyncMutex_4ef16dce
# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsNT
# REGISTRY
HKCUSoftwareMicrosoftWindowsCurrentVersionRunUpdate
# FILEPATH
%APPDATA%RoamingAsyncRATAsyncRAT.exe
# FILEPATH
%TEMP%SYN.exe
# FILEPATH
%TEMP%AsyncTask.exe
# FILEPATH
%APPDATA%AsyncRATclient.exe
# URL
https://async-rat-cdn.top/payload.exe
| Тип | Значение | Примечание |
|---|---|---|
| sha256 | 8c66c93d00fd52ad2efc773b29e339f3164bca178ea201009ba7d65a21f62e51 | |
| md5 | 8b4d740adbe4635b5ee756b7a6bf996d | |
| ip | 185.220.101.12 | C2:6606 |
| ip | 45.86.86.159 | C2:4444 |
| ip | 193.142.146.68 | C2:7707 |
| ip | 149.102.143.58 | C2:6606 |
| ip | 89.187.167.118 | C2:4449 |
| ip | 185.238.228.50 | AsyncRAT C2 Avrupa |
| ip | 5.39.63.112 | AsyncRAT C2 Fransa |
| ip | 193.142.146.35 | C2:6606 |
| ip | 37.48.89.107 | C2:4782 |
| domain | async-control.ddns.net | AsyncRAT DDNS C2 domain |
| domain | remote-admin-panel.ru | AsyncRAT panel domain - Russia hosting |
| domain | my-home-server.zapto.org | AsyncRAT dynamic DNS C2 |
| mutex | AsyncMutex_6SI8OkPnk | AsyncRAT default mutex - builder degistirilmemis |
| mutex | GlobalAsyncTask2025 | AsyncRAT 2025 varyant - custom mutex |
| mutex | AsyncMutex_4ef16dce | AsyncRAT default mutex |
| registry | HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsNT | AsyncRAT persistence - system process adina |
| registry | HKCUSoftwareMicrosoftWindowsCurrentVersionRunUpdate | AsyncRAT Run key |
| filepath | %APPDATA%RoamingAsyncRATAsyncRAT.exe | AsyncRAT dropped binary path |
| filepath | %TEMP%SYN.exe | AsyncRAT temp dropper |
| filepath | %TEMP%AsyncTask.exe | AsyncRAT dropped loader |
| filepath | %APPDATA%AsyncRATclient.exe | AsyncRAT istemci yolu |
| url | https://async-rat-cdn.top/payload.exe | AsyncRAT payload delivery URL |
C2 Серверы (8 зарегистрированных серверов для этого семейства)
| Адрес | Тип | Порт | Протокол | Статус | Страна |
|---|---|---|---|---|---|
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
Адреса C2 предоставляются только на основе образцов вредоносного ПО, вручную проверенных командой KEYDAL. Коммерческое использование запрещено.