asyncrat

General

Target

35ff5f54ce6916b53bddc3b3d4acb854
Size

3.3MB
Sample

211109-cx1f4abebm
MD5

35ff5f54ce6916b53bddc3b3d4acb854
SHA1

f90ecfdef0c315285a43ee6f14717679916453cc
SHA256

878ae0892199581e106ef623d98801cab28341b1b969eaeff6a3704c580dce76
SHA512

a79a316ce197ccab1f9090436195557420f833ecb2bb84e1f15ab60beb0d2bd0c3d9b013b22c38ba3f53d3c430ae0295c842c2ca288cfbda3514d0acfc24fec3

Score

10^/10

Malware Config

Targets

- Target
  
  35ff5f54ce6916b53bddc3b3d4acb854
- Size
  
  3.3MB
- MD5
  
  35ff5f54ce6916b53bddc3b3d4acb854
- SHA1
  
  f90ecfdef0c315285a43ee6f14717679916453cc
- SHA256
  
  878ae0892199581e106ef623d98801cab28341b1b969eaeff6a3704c580dce76
- SHA512
  
  a79a316ce197ccab1f9090436195557420f833ecb2bb84e1f15ab60beb0d2bd0c3d9b013b22c38ba3f53d3c430ae0295c842c2ca288cfbda3514d0acfc24fec3
Score

10^/10

asyncrat agilenet discovery evasion persistence rat spyware stealer suricata themida trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
  suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
  suricata
- Async RAT payload
  rat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2