asyncrat

General

Target

641073a7b38fa3b3e938af4810596eaf53a89e565919d.exe
Size

813KB
Sample

210430-9lambkjr5a
MD5

c4bb2285a9f20e982707e4c9ee4f7e35
SHA1

0021818c5bbc147738f323a98e42131411471db8
SHA256

641073a7b38fa3b3e938af4810596eaf53a89e565919dc505bf055f091d0b509
SHA512

a1c4a206dc99e1ef40cbec21fd1acf43323e13be94483367156c8abeda7fa0ee0f9269c27271015c4bd9b465e99122cf6611d96a08891b0b9ff0dca1f212c9d7

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://greenco2020.top/

http://greenco2021.top/

http://greenco2022.top/

rc4.i32

Targets

- Target
  
  641073a7b38fa3b3e938af4810596eaf53a89e565919d.exe
- Size
  
  813KB
- MD5
  
  c4bb2285a9f20e982707e4c9ee4f7e35
- SHA1
  
  0021818c5bbc147738f323a98e42131411471db8
- SHA256
  
  641073a7b38fa3b3e938af4810596eaf53a89e565919dc505bf055f091d0b509
- SHA512
  
  a1c4a206dc99e1ef40cbec21fd1acf43323e13be94483367156c8abeda7fa0ee0f9269c27271015c4bd9b465e99122cf6611d96a08891b0b9ff0dca1f212c9d7
Score

10^/10

asyncrat redline smokeloader backdoor discovery infostealer persistence rat spyware stealer trojan upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Modifies WinLogon for persistence
  persistence
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Async RAT payload
  rat
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2