asyncrat

General

Target
a8cbbdba951de49ff61ebf96f5f7b793.exe
Size 787KB
Sample210626-7mdd6n2zza
SHA256 d1621aa8dd1273a4b6e4f3e6b83188044af80c6ffe9aba2e7e191f159ce9b1eb
MD5 a8cbbdba951de49ff61ebf96f5f7b793
SHA1 7389456ef535facc9fbde433b4286c618df806e7
SHA512 95ffb8f278159bc26b86baef26c7f60680b84ae656386c252199b7307ef97971338336cd6d19ad3fd95fb3b893086248292dc2c60e319a1c03be0b2d93763bc1
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

oski

C2

veronikaa.ac.ug

Extracted

Family

raccoon

Botnet

67a1a4d96e0af06ab629d8d5c048c516a37dbc35

Attributes

url4cnc
https://tttttt.me/brikitiki

rc4.plain

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

remcos

Version

3.1.4 Light

Botnet

vvvvvvvvvv

C2

nothinglike.ac.ug:6969
brudfascaqezd.ac.ug:6969

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
daxvxdsaxzcas-LAPFBZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Targets

- Target
  a8cbbdba951de49ff61ebf96f5f7b793.exe
- Size 787KB
- SHA256 d1621aa8dd1273a4b6e4f3e6b83188044af80c6ffe9aba2e7e191f159ce9b1eb
- MD5 a8cbbdba951de49ff61ebf96f5f7b793
- SHA1 7389456ef535facc9fbde433b4286c618df806e7
- SHA512 95ffb8f278159bc26b86baef26c7f60680b84ae656386c252199b7307ef97971338336cd6d19ad3fd95fb3b893086248292dc2c60e319a1c03be0b2d93763bc1
- MD5 SHA1 SHA512
Score

10^/10

asyncrat azorult oski raccoon remcos 67a1a4d96e0af06ab629d8d5c048c516a37dbc35 vvvvvvvvvv discovery evasion infostealer persistence rat spyware stealer trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Oski
  Oski is an infostealer targeting browser data, crypto wallets.
  infostealer oski
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Async RAT payload
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2