asyncrat

General

Target

a977f111b6cfc531aaa949a1142b573fd1737d23f3a97077b69ef37433abb6b4
Size

145KB
Sample

221001-npsl3afhg7
MD5

14f6a0b91e54b9639ab359f1964a8619
SHA1

2bc241344727fdcc6f85679e625529940011bab3
SHA256

a977f111b6cfc531aaa949a1142b573fd1737d23f3a97077b69ef37433abb6b4
SHA512

c9bd1002a666ce121074b39eeaaa2e2fd1c401d1cc245bd226f31691a0f0c94ff6d7dc9e9465b13b26f7d90b01c06b63ef0e8bb828260a3ea24b2a0a2812fc04
SSDEEP

1536:Cdqmf/JrcspSf2IZR6rVHq/5mIOuND//B6AmvpkP3S2KbLL+EnZlNo6erbXlWZ:CdZ5XIZRoVKxpX/UAmvpkfSjL+2JtZ

Score

10^/10

asyncrat redline smokeloader 1 default inslab26 backdoor discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

inslab26

C2

185.182.194.25:8251

Attributes

auth_value
7c9cbd0e489a3c7fd31006406cb96f5b

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

45.154.98.214:6606

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

redline

Botnet

1

C2

93.159.221.122:8387

Targets

- Target
  
  a977f111b6cfc531aaa949a1142b573fd1737d23f3a97077b69ef37433abb6b4
- Size
  
  145KB
- MD5
  
  14f6a0b91e54b9639ab359f1964a8619
- SHA1
  
  2bc241344727fdcc6f85679e625529940011bab3
- SHA256
  
  a977f111b6cfc531aaa949a1142b573fd1737d23f3a97077b69ef37433abb6b4
- SHA512
  
  c9bd1002a666ce121074b39eeaaa2e2fd1c401d1cc245bd226f31691a0f0c94ff6d7dc9e9465b13b26f7d90b01c06b63ef0e8bb828260a3ea24b2a0a2812fc04
- SSDEEP
  
  1536:Cdqmf/JrcspSf2IZR6rVHq/5mIOuND//B6AmvpkP3S2KbLL+EnZlNo6erbXlWZ:CdZ5XIZRoVKxpX/UAmvpkfSjL+2JtZ
Score

10^/10

asyncrat redline smokeloader 1 default inslab26 backdoor discovery infostealer rat spyware stealer trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Async RAT payload
  rat
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1