asyncrat

General

Target

WinOptimizer.18.00.18.Portable.exe
Size

22.6MB
Sample

211106-xc9jgsfba5
MD5

1039e3867fa26e4e38c3a7fafbeb9013
SHA1

6dc045db152ab59be6e3bb5fa28a3adeea1cb06c
SHA256

a7521b44c71baaaa5ac4c74b1918196713fee07470a48cbd27b2c46142375154
SHA512

448ef4504a2202bf0f86fc2a3345d61c53465a96c8a9c6f773475719b1b4e723241bb6bd673b416337891598f910f9e6fc9bf4fe5925bca9981d58550699b45c

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

pettbull.ddns.net:53896

127.0.0.1:53896

Mutex

5bb33a25-3661-40a6-bf27-e3cf4c873773

Attributes

activate_away_mode
false
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-12-19T09:35:29.334939436Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
53896
default_group
MIX221
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
5bb33a25-3661-40a6-bf27-e3cf4c873773
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
pettbull.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

MIXONE

C2

pettbull.ddns.net:6606

pettbull.ddns.net:7707

pettbull.ddns.net:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

anti_vm
false
bsod
false
delay
3
install
true
install_file
Windows Microsoft.exe
install_folder
%AppData%
pastebin_config
null

aes.plain

Extracted

Family

quasar

Version

1.4.0

Botnet

MIX21

C2

pettbull.ddns.net:4782

Mutex

69383ffd-4823-44c2-b21f-a105f85ed9a0

Attributes

encryption_key
DAE9E02E5E04D59D9AF2AA1D5E82248D5919AC6A
install_name
Windows Service.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Windows
subdirectory
Windows Update

Targets

- Target
  
  CFB1EE668FC3E25580C334AB753749D2EF5A44AB9BE1E033047345827696CBF8
- Size
  
  22.7MB
- MD5
  
  55287c8aa442a3f521aabb6a80b3f6a8
- SHA1
  
  5e9c38e66448c4c1b8066b04987eb62cf6f48763
- SHA256
  
  cfb1ee668fc3e25580c334ab753749d2ef5a44ab9be1e033047345827696cbf8
- SHA512
  
  2d265bb941c28944ae7a25dea43d6122e04e549d349fc8276670683926feac52b12d3de42b0601d134f3842641b28751a62c8ddc28e3a3140f2041dfdf629813
Score

10^/10

asyncrat nanocore neshta quasar mix21 mixone discovery evasion keylogger persistence rat spyware stealer trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Detect Neshta Payload
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Quasar Payload
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Async RAT payload
  rat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2