asyncrat

General

Target

e4d8a5580372bcff92a7be2f385eb7f7.exe
Size

350KB
Sample

210430-6rtq1yym2a
MD5

e4d8a5580372bcff92a7be2f385eb7f7
SHA1

31b731099104f5dfda61b79dcea723d3cd5e1d84
SHA256

19f17d84c67985de677ea0f746955f709106d8833311d3b8c9b67491d0498ff0
SHA512

ce95e7bd0cc55223423c43c3c8fb33ef2e206dd13381759ac4ab59139792b9b20e5e6b87b54be9adfa431759a0736d9c699dec4912ad763492c1d1d86c0d2916

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

C2

null:null

Mutex

Aakn1515knAakn1515kn!

Attributes

aes_key
8qTK5zOGKTFDhfISYupTRvALhuVbWSgX
anti_detection
false
autorun
false
bdos
false
delay
-=-=-=-=-=SPOOFER-=-=-=-=-=
host
null
hwid
3
install_file
install_folder
%AppData%
mutex
Aakn1515knAakn1515kn!
pastebin_config
https://pastebin.com/raw/uqaaCRiU
port
null
version
0.5.7B

aes.plain

Extracted

Family

smokeloader

Version

2020

C2

http://greenco2020.top/

http://greenco2021.top/

http://greenco2022.top/

rc4.i32

Targets

- Target
  
  e4d8a5580372bcff92a7be2f385eb7f7.exe
- Size
  
  350KB
- MD5
  
  e4d8a5580372bcff92a7be2f385eb7f7
- SHA1
  
  31b731099104f5dfda61b79dcea723d3cd5e1d84
- SHA256
  
  19f17d84c67985de677ea0f746955f709106d8833311d3b8c9b67491d0498ff0
- SHA512
  
  ce95e7bd0cc55223423c43c3c8fb33ef2e206dd13381759ac4ab59139792b9b20e5e6b87b54be9adfa431759a0736d9c699dec4912ad763492c1d1d86c0d2916
Score

10^/10

asyncrat smokeloader backdoor persistence rat trojan upx redline discovery infostealer spyware stealer
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Modifies WinLogon for persistence
  persistence
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Async RAT payload
  rat
- Nirsoft
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2