asyncrat

Resubmissions

03-07-2021 16:35

210703-cwatrnq5as 10

03-07-2021 16:30

210703-q8f21sleh2 10

Sharing

Copy URL

Twitter E-mail

General

Target

main_setup_x86x64 sample.zip
Size

3.7MB
Sample

210703-cwatrnq5as
MD5

5dffcf661e97e437667afa441b80c8e1
SHA1

d1d4fa74d351237f95ab0d17d6663bfc13cdd9da
SHA256

edbef1ff8b32d420c7194a09a1b5872498ed086194a54df430a65686d07c5224
SHA512

dc62d708a9386089e642f9bd808b0fe2a33d88d11fb4fab97e909f7e5b85ada1b6935b0c6d82ef3323f6bd7b9f7c6a7e3139e26b5496f85609adae792f938f4c

Malware Config

Extracted

Path

C:\_readme.txt

Ransom Note

ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-fhnNOAYC8Z Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0313ewgfDdSgcyhrmIFKlwG8I3XxekHbYahiFXX0aowKJPQVTk

Emails

[email protected]

URLs

https://we.tl/t-fhnNOAYC8Z

Extracted

Family

redline

Botnet

Cana

176.111.174.254:56328

Extracted

Family

vidar

Version

39.4

Botnet

706

https://sergeevih43.tumblr.com

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

rc4.i32

Extracted

Family

asyncrat

Version

0.5.7B

null:null

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
3htbU7p8VLsbVqyiXfg3CvefpcBeyVlh
anti_detection
true
autorun
true
bdos
false
delay
Default
host
null
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
https://pastebin.com/raw/xV7ZAURy
port
null
version
0.5.7B

aes.plain

Extracted

Family

vidar

Version

39.4

Botnet

933

https://sergeevih43.tumblr.com

Attributes

profile_id
933

Extracted

Family

vidar

Version

39.4

Botnet

865

https://sergeevih43.tumblr.com

Attributes

profile_id
865

Targets

- Target
  
  main_setup_x86x64.exe
- Size
  
  3.7MB
- MD5
  
  864f64374dfb7e44d8129a27a85d9e2d
- SHA1
  
  1b9b3ba877ad016a80cf1559f2b3ca441acba801
- SHA256
  
  e780ff4870108ce42d51f95cdccdf38adbbbd1a89373e9390d4f133d77039146
- SHA512
  
  c4a82f0cd266d9ccf33f097f85e0df752f121c6c023da51d354c20e5bb27512393b59b228286fe9bdc72b31b221787731bb274ff062c02c5ee6bbc6f69d3bf85
Score

10^/10

asyncrat raccoon redline smokeloader tofsee vidar 706 865 933 cana aspackv2 backdoor discovery evasion infostealer persistence ransomware rat spyware stealer trojan upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Windows security bypass
  evasion trojan
- Async RAT payload
  rat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Blocklisted process makes network request
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Sets service image path in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1