asyncrat

General

Target

Fortnite Internal Esp AIm Clean Full_nls..scr
Size

2.6MB
Sample

220828-e2kmjscdbj
MD5

5361a2f1d174599ebc5b6cc31daf86f2
SHA1

ade74d0abac77203629b81513a739f11b39a52ef
SHA256

55af1ee79176f2503dc6cee5464344e6bbcaa4e37b4ae7217922c8e56ec395cf
SHA512

96381c583b975e4c2cd7ec70bd955936c48a9737036234241e37e73baf81c96cb28ab28d2fe3c53ed1e8ce0be641fba653d7e6877770cb8f60fb32f2c7b703b4
SSDEEP

49152:j8ASxr7FEi5LbunhHpj5G3FVhIdag5SNHeGJWrz:jTSt7FEGnCdpj5G3FVq18gGJ

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

WindowsDefendrSmartScreen

C2

217.64.31.3:9742

Mutex

WindowsDefendrSmartScreen

Attributes

delay
1
install
false
install_file
WindowsDefendrSmartScreen.exe
install_folder
%AppData%

aes.plain

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

uzVHE6

C2

http://fakirlerclub.xyz/blacknet

Mutex

BN[fdc98aef8b987490ccd4d376d67d69a7]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
e162b1333458a713bc6916cc8ac4110c
startup
false
usb_spread
false

Targets

- Target
  
  Fortnite Internal Esp AIm Clean Full_nls..scr
- Size
  
  2.6MB
- MD5
  
  5361a2f1d174599ebc5b6cc31daf86f2
- SHA1
  
  ade74d0abac77203629b81513a739f11b39a52ef
- SHA256
  
  55af1ee79176f2503dc6cee5464344e6bbcaa4e37b4ae7217922c8e56ec395cf
- SHA512
  
  96381c583b975e4c2cd7ec70bd955936c48a9737036234241e37e73baf81c96cb28ab28d2fe3c53ed1e8ce0be641fba653d7e6877770cb8f60fb32f2c7b703b4
- SSDEEP
  
  49152:j8ASxr7FEi5LbunhHpj5G3FVhIdag5SNHeGJWrz:jTSt7FEGnCdpj5G3FVq18gGJ
Score

10^/10

persistence asyncrat blacknet uzvhe6 windowsdefendrsmartscreen evasion rat trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- BlackNET
  BlackNET is an open source remote access tool written in VB.NET.
  trojan blacknet
- BlackNET payload
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Async RAT payload
  rat
- Downloads MZ/PE file
- Executes dropped EXE
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2